Xi Peng

In the AI-driven era, NVIDIA CUDA libraries have become indispensable for accelerating compute-intensive tasks, yet their security assessment remains critically understudied due to closed-source code and unique programming paradigms. Existing efforts primarily target CUDA compiler vulnerabilities (e.g., NVCC), but overlook broader library-specific risks. This paper addresses the challenges of fuzzing CUDA libraries: (1) context-dependent API ordering and closed-source opacity hinder the synthesis of valid, diverse API sequences; and (2) implicit parameter dependencies reduce the effectiveness of mutation for LLM-generated harnesses. Anewtool called CuFuzz has been proposed, aimed at uncovering potential vulnerabilities in the CUDA libraries. CuFuzz has the ability to generate testing harnesses for various CUDA library functions from scratch, perform efficient parameter mutation, and adapt to the needs of multiple CUDA libraries. First, LLMs are used to extract semantic relationships from CUDA documentation and sample codes, constructing a knowledge graph that prioritizes API interactions and contextual dependencies. The API coverage bitmap is proposed to guide the fuzzer to explore under-tested library functions. In addition to harness generation, the API knowledge graph is also combined with compiler diagnostics to repair erroneous harnesses, thereby improving compilation success rates. Subsequently, CuFuzz employs the LLMs to analyze and decouple parameter dependencies, separates out the mutable parameters, and performs parameter-isolated mutation on them to enhance mutation efficiency. Evaluated across three CUDA releases (12.4, 12.7, and 13.0) on eight widely adopted libraries (e.g., cuBLAS, cuFFT), CuFuzz achieves 2.97× higher API coverage and 4.0× superior API edge coverage relative to baseline (Fuzz4all), on average. The experiments uncovered 6 unknown bugs, validated by NVIDIA’s security team and obtained 2 CVEs.

Edge coverage-guided fuzzing has demonstrated remarkable achievements in vulnerability discovery. Some studies with fine-grained coverage metrics have been proposed to enhance the vulnerability mining capabilities of fuzzing by capturing more program paths. However, this refinement often results in a significant increase in seeds, which are highly homogeneous and may limit vulnerability detection. Additionally, finer granularity requires more bitmap hits, increasing the risk of hash collisions. To address these shortages, the paper proposes the structure of a basic block unit with multiple predecessors and successors (referred to as MPS). Then, a fine-grained coverage method called MPS-Fuzz is designed based on the MPS structure. In this approach, it is convenient to exclude basic blocks involving loop structures when determining MPS units, which helps reduce seed homogeneity. Additionally, we introduce an additional bitmap to record the coverage status of MPS units, ensuring that the collision rate of the edge bitmap does not increase. Moreover, these additional operations do not incur excessive time overhead. To demonstrate the properties of the MPS-Fuzz, we implement our approach on AFL and conduct experiments on 16 benchmarks from FuzzBench and Unifuzz. The result indicates that, after 24-hour fuzzing, MPS-Fuzz explores an average of 9.6% more edges and an average of 25.7% more bugs than AFL. Compared to other fine-grained coverage methods (N-gram and PathAFL), MPS-Fuzz also achieves better performance. Moreover, MPS-Fuzz has discovered a previously unknown bug on real-world program and got a CVE assigned.

Directed grey-box fuzzers focus on testing specific target code. They have been utilized in various security applications, such as reproducing known crashes and identifying vulnerabilities resulting from incomplete patches. Distance-guided directed fuzzers calculate the distance to the target node for each node in a CFG or CG, which has always been the mainstream in this field. However, the distance can only reflect the relationship between the current node and the target node, and it does not consider the impact of the reaching sequence before the target node. To mitigate this problem, we analyzed the properties of the instrumented function’s call graph after selective instrumentation, and the complexity of reaching the target function sequence was estimated. Assisted by the sequence complexity, we proposed a two-stage function call sequence-based seed-scheduling strategy. The first stage is to select seeds with a higher probability of generating test cases that reach the target function. The second stage is to select seeds that can generate test cases that meet the conditions for triggering the vulnerability as much as possible. We implemented our approach in SEZZ based on SelectFuzz and compare it with related works. We found that SEZZ outperformed AFLGo, Beacon, WindRanger, and SelectFuzz by achieving an average improvement of 13.7×, 1.50×, 9.78×, and 2.04× faster on vulnerability exposure, respectively. Moreover, SEZZ triggered three more vulnerabilities than the other compared tools.

With the dramatic rise of mobile internet users and the administrative requirements of long-term data retention, telecom providers are facing increasingly challenging storage and retrieval issues of call detail records (CDRs). The existing storage system can only achieve the requirement of online query and offline analysis of the CDRs. However, to the best of our knowledge, few studies have focused on the topic of CDRs retrieval optimization with long-term storage. In order to improve the retrieval speed while ensuring a high compression ratio, in this paper we propose a novel hash storage scheme, termed dual-column bucketing (DCB), based on the Hive platform by making use of its Bucketing nature. Compared to the conventional scheme, the proposed DCB scheme can improve the performance both for CDRs compression and query. Second, similar storage scenarios such as storage of SMS, email and extended detail records (XDRs) are included in the optimization scope of the DCB. Experiments on real-world CDRs show that in contrast to the conventional scheme, the proposed DCB scheme can save the storage space by approximately 40%, reduces the amount of disk read to 2%, and improve the retrieval speed of known phone number queries by up to seven times.