Google’s AI-powered bug hunting tool finds a host of troubling open source security flaws
- Google’s OSS-Fuzz finds more than twenty vulnerabilities in various open source projects
- Among them is a vulnerability in OpenSSL that could result in RCE
- Google considers this an important milestone in automated bug discovery
Google found 26 vulnerabilities in various open source code repositories, including a moderate flaw in “the critical OpenSSL library that underpins much of the Internet infrastructure.”
This wouldn’t really be news (Google has helped find thousands of bugs over the years) if the method by which the bugs were discovered wasn’t “artificial,” as the bugs were revealed using AI-powered fuzzing technology. tool. OSS Fuzz.
“These specific vulnerabilities represent a milestone in automated vulnerability finding: they were all found with AI, using AI-generated and enhanced fuzz targets,” Google explained in a blog post.
Major improvements with LLMs
Among these 26 flaws is an OpenSSL bug tracked as CVE-2024-9143. It has a severity score of 4.3 and is described as an out-of-bounds memory write error that can crash an app or allow scammers to conduct Remote Code Execution (ML) attacks. OpenSSL has since been upgraded to versions 3.3.3, 3.2.4, 3.1.8, 3.0.16, 1.1.1zb and 1.0.2zl to fix the bug.
To make matters even more interesting, Google said the vulnerability had most likely been present for 20 years, “and would not have been discovered using existing fuzz targets written by humans.”
The discovery of the bug was the result of two major improvements, the company further explained. The first is the ability to automatically generate more relevant context in the prompts, making the LLM “less likely to hallucinate the missing details in its response.” The second revolves around the LLM’s ability to emulate the entire workflow of a typical developer, including writing, testing, and iterating on the fuzz target, as well as reviewing the crashes found.
“This made it possible to further automate more parts of the fuzzing workflow. This additional iterative feedback, in turn, also resulted in higher quality and a greater number of correct fuzz targets.”
Via The hacker news
