FuzzySQL: 通过LLM驱动的模糊测试揭示数据库管理系统特殊功能中的隐藏漏洞
FuzzySQL: Uncovering Hidden Vulnerabilities in DBMS Special Features with LLM-Driven Fuzzing
AI总结：
FuzzySQL结合语法引导的SQL生成与逻辑偏移渐进变异技术，发现数据库管理系统特殊功能中的细微漏洞，揭示传统模糊测试在语义覆盖上的局限性。
摘要：
传统数据库模糊测试技术主要关注语法正确性和通用SQL结构，忽略了诸如系统级模式（如GTID）、程序性构造（如PROCEDURE）和高级进程命令（如KILL）等关键但隐秘的数据库管理系统功能。虽然这些功能通常不会被典型输入触发，但在边缘条件下的执行可能导致严重崩溃或安全问题。本文提出FuzzySQL，一种新型的LLM驱动自适应模糊测试框架，旨在揭示数据库管理系统特殊功能中的微妙漏洞。FuzzySQL结合语法引导的SQL生成与逻辑偏移渐进变异技术，一种新的技术通过否定条件和重构执行逻辑来探索替代的控制路径，合成结构和语义多样的测试用例。为确保后端更深入的执行覆盖，FuzzySQL采用混合错误修复流程，将基于规则的修补与LLM驱动的语义修补结合，使自动修正语法和上下文敏感的故障成为可能。我们对多个数据库管理系统进行了评估，包括MySQL、MariaDB、SQLite、PostgreSQL和Clickhouse，发现了64个漏洞，其中27个与未测试的数据库管理系统特殊功能有关。截至目前，60个案例已确认，9个已分配CVE标识符，31个已由供应商修复，还有更多漏洞计划在即将发布的版本中修复。我们的结果突显了传统模糊器在语义功能覆盖上的局限性，并展示了基于LLM的模糊测试发现复杂数据库系统中深层隐藏漏洞的潜力。
英文摘要：
Traditional database fuzzing techniques primarily focus on syntactic correctness and general SQL structures, leaving critical yet obscure DBMS features, such as system-level modes (e.g., GTID), programmatic constructs (e.g., PROCEDURE), advanced process commands (e.g., KILL), largely underexplored. Although rarely triggered by typical inputs, these features can lead to severe crashes or security issues when executed under edge-case conditions. In this paper, we present FuzzySQL, a novel LLM-powered adaptive fuzzing framework designed to uncover subtle vulnerabilities in DBMS special features. FuzzySQL combines grammar-guided SQL generation with logic-shifting progressive mutation, a novel technique that explores alternative control paths by negating conditions and restructuring execution logic, synthesizing structurally and semantically diverse test cases. To further ensure deeper execution coverage of the back end, FuzzySQL employs a hybrid error repair pipeline that unifies rule-based patching with LLM-driven semantic repair, enabling automatic correction of syntactic and context-sensitive failures. We evaluate FuzzySQL across multiple DBMSs, including MySQL, MariaDB, SQLite, PostgreSQL and Clickhouse, uncovering 64 vulnerabilities, 27 of which are tied to under-tested DBMS special features. As of this writing, 60 cases have been confirmed with 9 assigned CVE identifiers, 31 already fixed by vendors, and additional vulnerabilities scheduled to be patched in upcoming releases. Our results highlight the limitations of conventional fuzzers in semantic feature coverage and demonstrate the potential of LLM-based fuzzing to discover deeply hidden bugs in complex database systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
