Fuzzing grub: part 1
Nice walkthrough by Daniel Axtens of how to fuzz grub, which has a number of properties that make it tough to fuzz.

Bugs found in Database Management Systems
Postdoctoral researcher Manuel Rigger, advised by professor Zhendong Su, has created a tool SQLancer, that is able to automatically test Database Management Systems (DBMS) in order to find logic bugs in their implementation (bugs that cause the DBMS to fetch an incorrect result set). SQLancer has found over 400 bugs in databases including SQLite, MySQL, PostgreSQL, MariaDB, CockroachDB, and others. The bug-finding approaches implemented in SQLancer are described in three papers listed on this page.

Resmack: Grammar Fuzzing Thoughts - Part 1
Thoughts by James Johnson on resmack, the Rust-based grammar fuzzer he’s building. resmack includes dynamic rules, where one rule can reference another, local, named rule to generate a valid checksum. The post also references the Rust grammar fuzzer fzero by Brandon Falk, which was in tl;dr sec #15.

https://cdn2.hubspot.net/hubfs/5659664/Content/Whitepapers/FY19%20WP%20What%20is%20NGF%20v5.0.pdf?utm_campaign=Nurture&utm_source=hs_automation&utm_medium=email&utm_content=78472553&_hsenc=p2ANqtz-9sSfMxIgXsVXFmwX-w7Hkof1FLRn0ZCpZCM7VPtwAKzk2RpSVfs-h_dx6D0-rrcqWqFlNHZn4jKtSS3jNKROEbrtPBEEJOM6ytE8F9UYNuFDNoTwI&_hsmi=78472553

https://cdn2.hubspot.net/hubfs/5659664/Content/Whitepapers/FY19%20WP%20Buyers%20Guide%20v4.1.pdf?utm_campaign=Nurture&utm_source=hs_automation&utm_medium=email&utm_content=78472304&_hsenc=p2ANqtz–8xc2HQN37fOlgyhZ7iqJ8ccvMdnsyT_nWa_OJ6GZsWxIwZB6rsFOWlPbwUVLO5sGbaF_PPo0KwSqqH_XrXJz4_nbe2GS0uVbZ_dSIb5vTQJolfe4&_hsmi=78472304

https://cdn2.hubspot.net/hubfs/5659664/Content/Whitepapers/FY19%20WP%20Fuzzing%20Benchmark%20v4.1.pdf

https://cdn2.hubspot.net/hubfs/5659664/Content/Whitepapers/FY20%20WP%20Managing%20Software%20Supply%20Chain%20Risk%201.0.pdf?utm_campaign=Webinar%3A%20Automated%20Coverage&utm_source=hs_email&utm_medium=email&utm_content=85968317&_hsenc=p2ANqtz-_qT5x3k_fztz54MwgNdgvO7NmuUQZA7lXnfMt4cbawiKSKm6qcWtJuf9GexeCFJfApdH_AfQVGKClr3os8yDFH_tEQGszlxmqmbKCtUt9ASJaQGpk&_hsmi=85968317

CrashMonkey & Ace Systematically Testing File System Crash Consistency
Heisenbug 2019 talk by Jayashree Mohan:

We present a new approach to testing file-system crash consistency: bounded black-box crash testing (B3). B3 tests the file system in a black-box manner using workloads of file-system operations. Since the space of possible workloads is infinite, B3 bounds this space based on parameters such as the number of file-system operations or which operations to include, and exhaustively generates workloads within this bounded space. Each workload is tested on the target file system by simulating power-loss crashes while the workload is being executed and checking automatically if the file system recovers to a correct state after each crash.

CrashMonkey revealed 10 new crash-consistency bugs in widely-used, mature Linux file systems, seven of which existed in the kernel since 2014. It also revealed a data loss bug in a verified file system, FSCQ.

Fuzzing as a Service Companies

fuzzbuzz.io

FuzzLabs - https://www.linkedin.com/posts/activity-6627914989107720192–5I5/

ForAllSecure