[BUG]: Concurrent Access Vulnerability in vsomeip Test Program

[Bahgirl]

vSomeip Version

3.4.10

Boost Version

1.71

Environment

Ubuntu 20.04.6 LTS

Describe the bug

During testing of vsomeip with AFL++, a concurrency bug was identified. This vulnerability may lead to crashes or inconsistent behavior when vsomeip is concurrently accessed.

Reproduction Steps

Compile the test program.
mkdir build
cd build
cmake -DCMAKE_C_COMPILER=afl-clang-fast -DCMAKE_CXX_COMPILER=afl-clang-fast++ ..
make

Please refer to the specific CMakeLists.txt in the details.zip for details. For the program startup command, crash test cases, and test program, please refer to poc.txt in the details.zip.
details.zip

Expected behaviour

No response

Logs and Screenshots

No response

[lutzbichler]

I tried to reproduce. Building the test program succeeded (renamed it to fuzz_sample), but the execution fails with:

[lutz@vm build]$ afl-fuzz -D -t 5000 -i afl_in/ -o afl_out/ -- ./fuzz_sample
afl-fuzz++4.20c based on afl by Michal Zalewski and a large online community
[!] WARNING: Parameters -d and -D are deprecated, a new enhanced deterministic fuzzing is active by default, to disable it use -z
[+] AFL++ is maintained by Marc "van Hauser" Heuse, Dominik Maier, Andrea Fioraldi and Heiko "hexcoder" Eißfeldt
[+] AFL++ is open source, get it at https://github.com/AFLplusplus/AFLplusplus
[+] NOTE: AFL++ >= v3 has changed defaults and behaviours - see README.md
[+] No -M/-S set, autoconfiguring for "-S default"
[] Getting to work...
[+] Using exploration-based constant power schedule (EXPLORE)
[+] Enabled testcache with 50 MB
[+] Generating fuzz data with a length of min=1 max=1048576
[] Checking core_pattern...
[!] WARNING: Could not check CPU scaling governor
[+] You have 6 CPU cores and 4 runnable tasks (utilization: 67%).
[+] Try parallel jobs - see /usr/share/doc/afl/fuzzing_in_depth.md#c-using-multiple-cores
[] Setting up output directories...
[+] Output directory exists but deemed OK to reuse.
[] Deleting old session data...
[+] Output dir cleanup successful.
[] Checking CPU core loadout...
[+] Found a free CPU core, try binding to #0.
[] Scanning 'afl_in/'...

[-] The input directory does not seem to be valid - try again. The fuzzer needs
one or more test case to start with - ideally, a small file under 1 kB
or so. The cases must be stored as regular files directly in the input
directory.

[-] SYSTEM ERROR : Unable to open 'afl_in/'
Stop location : read_testcases(), src/afl-fuzz-init.c:714
OS message : No such file or directory