Concurrency bugs arising from asynchronous-synchronous interactions pose a serious and underexplored threat to OS kernel security. Conventional detection methods often fail to capture the delayed triggering nature of asynchronous tasks and their semantic relationships with synchronous execution contexts, limiting their ability to detect such bugs. We propose two key insights: explicit dependency modeling between execution paths, and contingent triggering of asynchronous tasks during associated synchronous execution. Based on this, we develop ASFuzz, an asynchronous fuzzing system that builds a Shadow Dependency Graph to capture scheduling relations, context-matched resource relations, and operation types. Leveraging the Shadow Dependency Graph, ASFuzz employs a dual-mode architecture: a coverage-guided phase explores synchronous paths and collects legitimate asynchronous-triggering seeds, while a shadow execution phase generates legal syscall programs that naturally schedule related asynchronous tasks during relevant synchronous contexts. An adaptive scheduler coordinates the process, balancing broad state exploration and targeted interleaving stress. We evaluated ASFuzz on Linux kernel versions 6.6 to 6.15. The results demonstrate that ASFuzz successfully uncovered 14 previously unknown concurrency-related bugs, including 10 asynchronous concurrency bugs; 5 of the 14 bugs have been assigned CVE identifiers. These findings validate the effectiveness of our dual insights and highlight ASFuzz’s capability in exposing deep and subtle asynchronous concurrency bugs through dependency-driven and context-sensitive testing.
Jianzhou Zhao, Yang-Yang Geng, Jing-Yi Wang et al.· IEEE Transactions on Informa...· 0 citations
Fault Localization (FL) is a critical yet inherently complex phase in the software debugging process. Over the years, numerous automated FL techniques have been developed to alleviate the time and effort involved. More recently, the emergence of Large Language Models (LLMs) has marked a new era for FL. However, existing LLM-based approaches often arrive at premature conclusions due to both extrinsic and intrinsic hallucinations. To address these challenges, we propose FaultLens, a novel FL technique that equips an LLM-based agent with a fine-grained feedback mechanism for repository-scale fault localization. Specifically, the decision-making stage of our approach starts with identifying FL candidates through an LLMbased agent. Here, location extraction validation detects extrinsic hallucinations, triggering further investigation. A defined rule determines investigation completion, while a self-check mechanism mitigates intrinsic hallucinations arising from incomplete investigation. The advanced location identification stage further minimizes intrinsic hallucinations caused by faulty reasoning. We demonstrate the effectiveness of our approach through a comprehensive evaluation on the Defects4J benchmark. Our results show that FaultLens outperforms several fault localization techniques across multiple categories, including spectrum-based methods, mutation analysis, machine learning approaches, and LLM-based systems. Specifically, FaultLens achieves a 43.35% improvement over SoapFL and a 24.24% improvement over AutoFL in the Top-1 metric, surpassing state-of-the-art LLM-based agent methods. Additional experiments further indicate that FaultLens generalizes across different programming languages and LLM backends, and that its hallucination-mitigation mechanisms are transferable to an external localization workflow.
Feiyu Chen, Guowei Yang, Cheryl Lee et al.· ACM Transactions on Software...· 0 citations
Programmable Logic Controllers (PLCs) are core components of Industrial Control System (ICS), and their security is essential for the reliable operation of critical infrastructure. However, PLCs are vulnerable to RunStage Attacks, which are runtime attacks that occur when the PLC is in the “Run” mode executing control logic. In the class of RunStage Attacks considered in this work, adversaries corrupt memory and hijack control flow to manipulate control logic. Due to the limited resources and stringent real-time requirements of PLCs, existing control flow defense schemes still suffer from shortcomings in resource usage and real-time performance. To address these challenges, we propose TLCFI-PLC, a trampoline-based lightweight control flow integrity scheme for defending against RunStage control flow hijacking attacks. The scheme consists of two phases: offline analysis and online monitoring. In the offline analysis phase, TLCFI-PLC parses the PLC binary control logic and employs trampoline-based instrumentation to constrain control flow execution, avoiding large-scale rewriting that could alter the memory layout or program size. It then extracts legitimate target addresses and execution paths to construct a control flow integrity baseline. In the online detection phase, the instrumented PLC records runtime control flow information to shared memory, where an asynchronous checker monitors execution paths and detects hijacking attempts. We implemented a prototype on a WAGO PLC running the CodeSys runtime environment. Experiments show that, among the 248 selected case studies, the sizes of the processed files ranged from 44 KB to 552 KB, and the instrumentation time was generally less than 5 seconds. Two supplementary sets of 10 binaries were evaluated: a scenario-oriented set for binary-size overhead, averaging below 1%, and a randomly selected set for scan-cycle time, which remained within acceptable limits. These results further confirm the robustness of the proposed scheme.
Kaixiang Liu, Junjiao Liu, Zhiwen Pan et al.· IEEE Transactions on Informa...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
