The LAVA Synthetic Bug Corpora

I'm planning a longer post discussing how we evaluated the LAVA bug injection system, but since we've gotten approval to release the test corpora I wanted to make them available right away.

The corpora described in the paper, LAVA-1 and LAVA-M, can be downloaded here:

http://panda.moyix.net/~moyix/lava_corpus.tar.xz (101M)

Quoting from the included README:

This distribution contains the automatically generated bug corpora used in the paper, "LAVA: Large-scale Automated Vulnerability Addition".

LAVA-1 is a corpus consisting of 69 versions of the "file" utility, each of which has had a single bug injected into it. Each bug is a named branch in a git repository. The triggering input can be found in the file named CRASH_INPUT. To run the validation, you can use validate.sh, which builds each buggy version of file and evaluates it on the corresponding triggering input.

LAVA-M is a corpus consisting of four GNU coreutils programs (base64, md5sum, uniq, and who), each of which has had a large number of bugs added. Each injected, validated bug is listed in the validated_bugs file, and the corresponding triggering inputs can be found in the inputs subdirectory. To run the validation, you can use the validate.sh script, which builds the buggy utility and evaluates it on triggering and non-triggering inputs.

For both corpora, the "backtraces" subdirectory contains the output of gdb's backtrace command for each bug.

Enjoy!

Comments

Unknown said…
Hey, I download the LAVA corpora, and I run the script validate.sh and get the result from the ubuntu terminal as following:
----------------------
Building buggy base64...
Checking if buggy base64 succeeds on non-trigger input...
Success: base64 -d inputs/utmp.b64 returned 127
Validating bugs...
Validated 0 / 44 bugs
You can see validated.txt for the exit code of each buggy version.
--------------------------
which means I don't succeed injecting bugs. One of the codes in validate.sh is "./configure --prefix=`pwd`/lava-install LIBS="-lacl" &> /dev/null", but I cannot find the directory "lava-install".
So how can I solve the problem? Thanks very much.
October 5, 2017 at 11:04 PM
Brendan Dolan-Gavitt said…
Hi,

127 is the error code bash returns when the program can't be found. So it sounds like some part of the compilation process is failing and none of the coreutils programs have actually been built. I'd recommend running the compile step by hand to see what's going wrong, and then fixing that.
October 5, 2017 at 11:55 PM
Unknown said…
Mr Dolan-Gavitt,thank you very much. I change the script validate.sh and remove the "&>/dev/null", and I build the program successfully.
The changed script is as following:
--------------------------------------------------------
#!/bin/bash
PROG="base64"
PROGOPT="-d"
INPUT_PATTERN="inputs/utmp-fuzzed-%s.b64"
INPUT_CLEAN="inputs/utmp.b64"
echo "Building buggy ${PROG}..."
cd coreutils-8.24-lava-safe
make clean
./configure --prefix=/home/wendy/lava_corpus/LAVA-M/base64/coreutils-8.24-lava-safe/lava-install LIBS="-lacl"
make
make install
cd ..
./coreutils-8.24-lava-safe/lava-install/bin/${PROG} ${PROGOPT} ${INPUT_CLEAN}
rv=$?
if [ $rv -lt 128 ]; then
echo "Success: ${PROG} ${PROGOPT} ${INPUT_CLEAN} returned $rv"
else
echo "ERROR: ${PROG} ${PROGOPT} ${INPUT_CLEAN} returned $rv"
fi
echo "Validating bugs..."
cat validated_bugs | while read line ; do
INPUT_FUZZ=$(printf "$INPUT_PATTERN" $line)
{ ./coreutils-8.24-lava-safe/lava-install/bin/${PROG} ${PROGOPT} ${INPUT_FUZZ} ; }
echo $line $?
done > validated2.txt
awk 'BEGIN {valid = 0} $2 > 128 { valid += 1 } END { print "Validated valid=",valid, "/
", NR, "bugs" }' validated2.txt
echo "You can see validated2.txt for the exit code of each buggy version."
--------------------------------------------------------------------------------
October 6, 2017 at 3:18 AM
Lingyun Situ's Blog said…
Hi,

There's a CRASH_INPUT in the the command in validate.sh

{ ${d}/lava-install/bin/file ${d}/CRASH_INPUT ; } &> /dev/null

But, I do not find the CRASH_INPUT dir.

Thanks



March 13, 2018 at 6:02 PM
Unknown said…
Hi,

I faced exactly the same terminal output as 0/44 bugs validated for base64 in lava-M corpus.

I tried with the new posted script without hte "&>/dev/null", i actually copied the posted script in a new file. However it gave an error that says:

configure: error: in `/home/mark_arsanious/lava_corpus/LAVA-M/base64/coreutils-8.24-lava-safe':
configure: error: C compiler cannot create executables
See `config.log' for more details

and a fatal error:

./lib/acl-internal.h:27:11: fatal error: 'sys/acl.h' file not found
# include
^


Any clue?

May 25, 2018 at 11:14 AM
pepper said…
I have trouble confirming all the vulnerable input vectors. What is the toolchain and target architecture that this is supposed to work with?

A recent Ubuntu will be unable to compile due to gnulib changes...porting the source is easy but the validate scripts will only confirm a small fraction of bugs. Its better with Ubuntu 16.04 but still, several hundret bugs could not be confirmed by the validation script. Crosscompiling for i386 also didn't seem to help..
September 15, 2019 at 1:38 PM
Kristian said…
I get following error when trying to compile base64:

lib/freadseek.c: In function 'freadptrinc':
lib/freadseek.c:68:3: error: #error "Please port gnulib freadseek.c to your platform! Look at the definition of getc, getc_unlocked on your system, then report this to bug-gnulib."
68 | #error "Please port gnulib freadseek.c to your platform! Look at the definition of getc, getc_unlocked on your system, then report this to bug-gnulib."
October 31, 2019 at 9:21 AM
Post a Comment

Popular posts from this blog

Someone’s Been Messing With My Subnormals!

Image
TL;DR: After noticing an annoying warning, I went on an absurd yak shave, and discovered that because of a tiny handful of Python packages built with an appealing-sounding but dangerous compiler option, more than 2,500 Python packages—some with more than a million downloads per month—could end up causing any program that uses them to compute incorrect numerical results. Once Upon a Time in My Terminal Recently, whenever I tried to import certain Python packages (notably, some models from Huggingface Transformers), I would see this weird and unsightly warning: Python 3.8.10 (default, Jun 22 2022, 20:18:18)   Type 'copyright', 'credits' or 'license' for more information IPython 8.4.0 -- An enhanced Interactive Python. Type '?' for help. In [ 1 ]: from transformers import CodeGenForCausalLM /home/moyix/.virtualenvs/sfcodegen/lib/python3.8/site-packages/numpy/core/getlimits.py:498: UserWarning: The value of the smallest subnormal for <class 'numpy.
Read more

Decrypting LSA Secrets

The LSA secrets store is a protected storage area used the the Local Security Authority (LSA) system in Windows to keep important pieces of information safe from prying eyes. As with Syskey, however, we will see that these secrets are only obfuscated, and once the mechanism is known, we can extract them from the registry with ease. Even without knowing the obfuscation algorithm, however, it is possible to read the values of this data using the LsarQuerySecret function exported by lsasrv.dll, but only if one has the LocalSystem privilege (for example, if the process is running under the SYSTEM account). What kind of data is stored in these secrets? Here are a few that I've come across: $MACHINE.ACC : has to do with domain authentication, see KB175468 DefaultPassword : password used to logon to Windows if auto-logon is enabled NL$KM : secret key used to encrypt cached domain passwords L$RTMTIMEBOMB_[...] : FILETIME giving the date when an unactivated copy of Windows w
Read more

SysKey and the SAM

The Security Accounts Manager The Security Accounts Manager , or SAM, has been used by Windows since the days of NT to store information on local user accounts (or, in the case of a domain controller, the accounts for all users on the domain). It takes the form of a registry hive, and is stored in %WINDIR%\system32\config . Generally, two types of hash are stored in the SAM: the LanMan hash and the NT hash. The LanMan hash has many flaws: It is not salted, and is thus vulnerable to precomputed dictionary attacks such as rainbow tables . The hash is split into two 7-byte pieces, which allows attacks to be performed against each piece at the same time. This also means that if the password is shorter than 7 characters, the last half of the hash will be a constant value. The password is converted to uppercase before hashing, which reduces the keyspace. The LM hash is computed by padding or truncating the password to 14 characters, splitting it into two halves, and then usin
Read more