Enhancing OSS-Fuzz and Jazzer to catch Log4Shell

The invention of the Log4Shell vulnerability has set the web on fireplace. Just like shellshock and heartbleed, Log4Shell is simply the newest catastrophic vulnerability in software program that runs the web. Our mission because the Google Open Supply Safety Workforce is to safe the open supply libraries the world is dependent upon, similar to Log4j. One in every of our capabilities on this house is OSS-Fuzz, a free fuzzing service that’s utilized by over 500 important open supply initiatives and has discovered greater than 7,000 vulnerabilities in its lifetime.

We need to empower open supply builders to safe their code on their very own. Over the following yr we are going to work on higher automated detection of non-memory corruption vulnerabilities similar to Log4Shell. We’ve got began this work by partnering with the safety firm Code Intelligence to present steady fuzzing for Log4j, as a part of OSS-Fuzz. Additionally as a part of this partnership, Code-Intelligence improved their Jazzer fuzzing engine to make it able to detecting distant JNDI lookups. We’ve got awarded Code Intelligence $25,000 for this effort and can proceed to work with them on securing the open supply ecosystem.

Caption: OSS-Fuzz and Jazzer discovering the Log4Shell Vulnerability

Vulnerabilities like Log4Shell are an eye-opener for the business when it comes to new assault vectors. With OSS-Fuzz and Jazzer, we will now detect this class of vulnerability in order that they are often mounted earlier than they turn out to be an issue in manufacturing code.

Over the previous yr we now have made quite a few investments to strengthen the safety of important open supply initiatives, and just lately introduced our $10 billion dedication to cybersecurity protection together with $100 million to help third-party foundations that handle open supply safety priorities and assist repair vulnerabilities.

We recognize the maintainers, safety engineers and incident responders which might be working to mitigate Log4j and make our web ecosystem safer.

Take a look at our documentation to get began utilizing OSS-Fuzz.