Bug Composition: Triggering Multiple Bugs with Agentic Driver Generation

Abstract

Security vulnerabilities caused by bugs in software do not exist in isolation. Attackers can chain vulnerabilities caused by multiple bugs together to achieve their goals. However, determining whether multiple vulnerabilities can be triggered during a single execution is a difficult problem. In this paper, we present an agentic pipeline for automatically discovering whether a single shared input can trigger multiple bugs. In particular, we introduce an agentic approach that automatically generates predicates and constraint-based harnesses from buggy code, leveraging symbolic execution and SMT solving. We validate our approach using real-world vulnerabilities across three widely used, open source libraries: tcpdump, libxml2, and nDPI. Our pipeline successfully generates concrete shared inputs to trigger multiple bug pairs, including heap buffer overflows in tcpdump, stack and heap memory corruptions in libxml2 and out-of-bounds reads across independent protocol dissectors in nDPI. Furthermore, our methodology correctly identifies and proves the absence of shared inputs when bugs require mutually exclusive constraints. Our work introduces and demonstrates the feasibility of automated bug composition analysis, results of which can be valuable in identifying potential exploit chains and prioritizing critical vulnerabilities for patching.