Initial details about why CrowdStrike's CSAgent.sys crashed

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by Retr0id on Sunday July 21, 2024 @07:04AM (#41024161)

Competent fuzzers don't just use random bytes, they systematically explore the state-space of the target program. If there's a crash state to be found by feeding in a file full of null bytes, it's probably going to be found quickly.

A fun example is that if you point AFL at a JPEG parser, it will eventually "learn" to produce valid JPEG files as test cases, without ever having been told what JPEG file is supposed to look like. https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-th...

[ Parent | on HN ]

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by rwmj on Sunday July 21, 2024 @08:18AM (#41024563)

AFL is really "magical". It finds bugs very quickly and with little effort on our part except to leave it running and look at the results occasionally. We use it to fuzz test a variety of file formats and network interfaces, including QEMU image parsing, nbdkit, libnbd, hivex. We also use clang's libfuzzer with QEMU which is another good fuzzing solution. There's really no excuse for CrowdStrike not to have been using fuzzing.

[ Parent | on HN ]