Security Blog
The latest news and insights from Google on security and safety on the Internet
ClusterFuzzLite: Continuous fuzzing for all
November 11, 2021
Posted by Jonathan Metzman, Google Open Source Security Team
In recent years,
continuous fuzzing
has become an essential part of the software development lifecycle. By feeding unexpected or random data into a program, fuzzing catches bugs that would otherwise slip through the most thorough manual checks and provides coverage that would take staggering human effort to replicate.
NIST’s guidelines for software verification
, recently released in response to the White House
Executive Order on Improving the Nation’s Cybersecurity
, specify fuzzing among the minimum standard requirements for code verification.
Today, we are excited to announce
ClusterFuzzLite
, a continuous fuzzing solution that runs as part of CI/CD workflows to find vulnerabilities faster than ever before. With just a few lines of code, GitHub users can integrate ClusterFuzzLite into their workflow and fuzz pull requests to catch bugs before they are committed, enhancing the overall security of the software supply chain.
Since its release in 2016, over 500 critical open source projects have integrated into Google’s
OSS-Fuzz
program, resulting in over
6,500
vulnerabilities and
21,000
functional bugs being fixed. ClusterFuzzLite goes hand-in-hand with OSS-Fuzz, by catching regression bugs much earlier in the development process.
Large projects including
systemd
and
curl
are already using ClusterFuzzLite during code review, with positive results. According to Daniel Stenberg, author of curl, “When the human reviewers nod and have approved the code and your static code analyzers and linters can't detect any more issues, fuzzing is what takes you to the next level of code maturity and robustness. OSS-Fuzz and ClusterFuzzLite help us maintain curl as a quality project, around the clock, every day and every commit.”
With the release of ClusterFuzzLite, any project can integrate this essential testing standard and benefit from fuzzing. ClusterFuzzLite offers many of the same features as
ClusterFuzz
, such as continuous fuzzing, sanitizer support, corpus management, and coverage report generation. Most importantly, it’s easy to set up and works with closed source projects, making ClusterFuzzLite a convenient option for any developer who wants to fuzz their software.
With ClusterFuzzLite, fuzzing is no longer just an idealized "bonus" round of testing for those who have access to it, but a critical must-have step that everyone can use continuously on every software project. By finding and preventing bugs before they enter the codebase we can build a more secure software ecosystem.
To learn more, check out the
ClusterFuzzLite documentation
. ClusterFuzzLite currently supports
GitHub Actions
,
Google Cloud Build
and
Prow
. We built this with CI system extensibility in mind, and adding support for other CI systems is straightforward. Please
contact us
if you’re interested in contributing support, or have any questions, feedback or feature requests.
Trick & Treat! 🎃 Paying Leets and Sweets for Linux Kernel privescs and k8s escapes
November 1, 2021
Posted by Eduardo Vela, Google Bug Hunters Team
Starting today and for the next 3 months (until January 31 2022), we will pay 31,337 USD to security researchers that exploit privilege escalation in our lab environment with a patched vulnerability, and 50,337 USD to those that use a previously unpatched vulnerability, or a new exploit technique.
We are constantly investing in the security of the Linux Kernel because much of the internet, and Google—from the devices in our pockets, to the services running on
Kubernetes
in the cloud—depend on the security of it. We
research its vulnerabilities and attacks
, as well as
study and develop its defenses
.
But we know that there is more work to do. That’s why we have decided to build on top of our
kCTF VRP
from last year and triple our previous reward amounts (for at least the next 3 months).
Our base rewards for each publicly patched vulnerability is 31,337 USD (at most one exploit per vulnerability), but the reward can go up to 50,337 USD in two cases:
If the vulnerability was otherwise unpatched in the Kernel (0day)
If the exploit uses a new attack or technique, as determined by Google
We hope the new rewards will encourage the security community to explore new Kernel exploitation techniques to achieve privilege escalation and drive quicker fixes for these vulnerabilities. It is important to note, that the easiest exploitation primitives are not available in our lab environment due to the hardening done on
Container-Optimized OS
. Note this program complements Android's VRP rewards, so exploits that work on Android could also be eligible for up to
250,000 USD
(that's in addition to this program).
The mechanics are:
Connect to the
kCTF VRP cluster
, obtain root and read the flag (read
this writeup
for how it was done before, and
this threat model
for inspiration), and then submit your flag and a checksum of your exploit
in this form
.
(If applicable) report vulnerabilities to
upstream
.
We strongly recommend including a patch since that could qualify for an
additional reward
from our Patch Reward Program, but please report vulnerabilities upstream promptly once you confirm they are exploitable.
Report your finding
to Google VRP once all patches are publicly available (we don't want to receive details of unpatched vulnerabilities ahead of the public.)
Provide the exploit code and the algorithm used to calculate the hash checksum.
A rough description of the exploit strategy is welcome.
Reports will be triaged on a weekly basis. If anyone has problems with the lab environment (if it's unavailable, technical issues or other questions), contact us on Discord in
#kctf
. You can read more details about the program
here
. Happy hunting!
Labels
#sharethemicincyber
#supplychain #security #opensource
android
android security
android tr
app security
big data
biometrics
blackhat
C++
chrome
chrome enterprise
chrome security
connected devices
CTF
diversity
encryption
federated learning
fuzzing
Gboard
google play
google play protect
hacking
interoperability
iot security
kubernetes
linux kernel
memory safety
Open Source
pha family highlights
pixel
privacy
private compute core
Rowhammer
rust
Security
security rewards program
sigstore
spyware
supply chain
targeted spyware
tensor
Titan M2
VDP
vulnerabilities
workshop
Archive
2024
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2023
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2022
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2021
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2020
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2019
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2018
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2017
Dec
Nov
Oct
Sep
Jul
Jun
May
Apr
Mar
Feb
Jan
2016
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2015
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2014
Dec
Nov
Oct
Sep
Aug
Jul
Jun
Apr
Mar
Feb
Jan
2013
Dec
Nov
Oct
Aug
Jun
May
Apr
Mar
Feb
Jan
2012
Dec
Sep
Aug
Jun
May
Apr
Mar
Feb
Jan
2011
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
2010
Nov
Oct
Sep
Aug
Jul
May
Apr
Mar
2009
Nov
Oct
Aug
Jul
Jun
Mar
2008
Dec
Nov
Oct
Aug
Jul
May
Feb
2007
Nov
Oct
Sep
Jul
Jun
May
Feed
Follow @google
Follow
Give us feedback in our
Product Forums
.
Follow