Cache Crashers

Stripe's memcache proxy, a component that routes requests through configurable Lua logic, had drawn little outside scrutiny despite growing use in its caching infrastructure. The talk explains memcache as a RAM-only key-value cache with its own text and meta protocols, which makes its hand-written parser a promising fuzzing target. Because memcache ships as one monolithic binary, the team linked against its object files and fed AFL inputs straight into the proxy's request parsing code.

Running at about 4,000 executions per second on a single CPU, the fuzzer produced around 80 crashes in a week, many sharing one root cause. The most useful finding was a stack-based buffer overflow in multi-get handling, where long runs of spaces between tokens let copies overrun a small stack buffer. The speaker walks through how this could be steered toward control of the stack and the connection object, and how stack canaries and other mitigations would complicate exploitation. The crash was confined to the proxy rather than upstream data nodes, and it has since been fixed in the latest release.

On the defensive side, a crude rule that flagged oversized get requests followed by a process fork would miss payloads that stay in memory. A better signature re-implemented memcache's tokenization and checked the gaps between tokens, catching the malformed request on the wire whatever the exploit did next. The takeaways are to keep memcache forks patched, to know a target deeply before fuzzing, and to consider Google's OSS-Fuzz for free continuous fuzzing of C code.