Extending Ruzzy with LibAFL
Trail of Bits detailed the technical process of integrating the LibAFL fuzzing engine into Ruzzy, their coverage-guided fuzzer for Ruby. The integration required resolving ELF linker constraints with .preinit_array sections and adjusting shared object loading to satisfy LibAFL's strict coverage map initialization requirements.
Authors: Trail of Bits
What Happened
Security researchers have updated a tool called Ruzzy, which is used to find bugs in Ruby programming code, to use a newer and more advanced bug-finding engine called LibAFL. During the update, the developers had to solve technical issues related to how the software is built and how it tracks the code it tests. This update matters because it gives developers better tools to discover and fix security flaws in their software before attackers can exploit them. Software developers and security testers can now use the latest version of Ruzzy to proactively test their Ruby applications for vulnerabilities.
Key Takeaways
- Ruzzy, a coverage-guided fuzzer for Ruby, has been updated to support the LibAFL fuzzing engine as an alternative to LLVM's libFuzzer.
- Integrating LibAFL required bypassing a GNU ld linker restriction regarding .preinit_array sections in dynamic shared objects by switching to LLVM's lld.
- Unlike libFuzzer, LibAFL requires coverage maps to be initialized before the fuzzer starts, necessitating changes to how Ruzzy loads instrumented shared objects.
Affected Systems
- Ruby C extensions
- Linux fuzzing environments
Attack Chain
N/A - This article discusses the development and integration of a fuzzing tool (Ruzzy with LibAFL) for vulnerability research, rather than detailing a malicious attack chain.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
N/A
Detection Engineering Assessment
EDR Visibility: None — The article discusses local fuzzing tool development, which does not generate malicious telemetry. Network Visibility: None — Fuzzing operations described are local to the host and do not involve network traffic. Detection Difficulty: N/A — Not applicable to threat detection.
Recommendations
Immediate Mitigation
- N/A
Infrastructure Hardening
- N/A
User Protection
- N/A
Security Awareness
- Encourage developers to use fuzzing tools like Ruzzy and LibAFL to proactively discover memory corruption and other vulnerabilities in Ruby C extensions during the development lifecycle.
