Sequence-Oriented DBMS Fuzzing

The SQL specification consists of hundreds of statement types, which leads to difficulties in DBMS fuzzing: stateof-the-art works generally reuse the statements of predefined types; the limited types cannot cover the full input space and test the corresponding logic consequently. In this paper, we propose LEGO, a fuzzer to generate SQL sequences with abundant types to improve DBMS fuzzing coverage. The key idea of sequence generation is type-affinity, which indicates the meaningful occurrence of SQL type pairs (e.g., INSERT and SELECT). During each fuzzing iteration, LEGO first proactively explores SQL statements of different types and analyzes affinities with coverage feedback. Next, when a new affinity is discovered, LEGO synthesizes new SQL sequences containing the types progressively.

We evaluate LEGO on PostgreSQL, MySQL, MariaDB, and Comdb2 against SQLancer, SQLsmith, and SQUIRREL. The sequence-oriented fuzzing helps LEGO outperform other fuzzers on branch coverage by 44%-198%. More importantly, in the continuous fuzzing, LEGO has discovered 102 new vulnerabilities confirmed by the corresponding vendors, including 6 bugs in PostgreSQL, 21 bugs in MySQL, 42 bugs in MariaDB, and 33 bugs in Comdb2. Among them, 22 CVEs have been assigned due to their severe security influences.