CVFuzz: Detecting complexity vulnerabilities in OpenCL kernels via automated pathological input generation

OpenCL programs typically employ complex storage models and diverse data types as well as manifest various memory access patterns, which make it challenging to detect the performance problems effectively. However, few research efforts have been dedicated to cope with this challenge so far. In this paper, we introduce CVFuzz, a domain-independent tool that can effectively detect and locate algorithmic complexity vulnerabilities in OpenCL kernels. The key enabling idea is leveraging automatically generated pathological inputs to trigger the worst-case behavior during the execution of OpenCL kernels. Our approach takes advantage of the metrics such as code coverage and run time to guide the generation of inputs that can slow down the execution of a given OpenCL kernel. We evaluate CVFuzz on more than 250 real-world OpenCL kernels. The evaluation results demonstrate that the inputs generated by CVFuzz are effective in detecting the worst-case time algorithmic complexity and optimization vulnerabilities.