Greybox fuzzing is the de-facto standard to discover bugs during development. Fuzzers execute many inputs to maximize the amount of reached code. Recently, Directed Greybox Fuzzers (DGFs) propose an alternative strategy that goes beyond "just" coverage: driving testing toward specific code targets by selecting "closer" seeds. DGFs go through different phases: exploration (i.e., reaching interesting locations) and exploitation (i.e., triggering bugs). In practice, DGFs leverage coverage to directly measure exploration, while exploitation is, at best, measured indirectly by alternating between different targets. Specifically, we observe two limitations in existing DGFs: (i) they lack precision in their distance metric, i.e., averaging multiple paths and targets into a single score (to decide which seeds to prioritize), and (ii) they assign energy to seeds in a round-robin fashion without adjusting the priority of the targets (exhaustively explored targets should be dropped). We propose FishFuzz, which draws inspiration from trawl fishing: first casting a wide net, scraping for high coverage, then slowly pulling it in to maximize the harvest. The core of our fuzzer is a novel seed selection strategy that builds on two concepts: (i) a novel multi-distance metric whose precision is independent of the number of targets, and (ii) a dynamic target ranking to automatically discard exhausted targets. This strategy allows FishFuzz to seamlessly scale to tens of thousands of targets and dynamically alternate between exploration and exploitation phases. We evaluate FishFuzz by leveraging all sanitizer labels as targets. Extensively comparing FishFuzz against modern DGFs and coverage-guided fuzzers shows that FishFuzz reached higher coverage compared to the direct competitors, reproduces existing bugs (70.2% faster), and finally discovers 25 new bugs (18 CVEs) in 44 programs.
翻译:Greybox furzzing 是开发过程中发现错误的脱法标准。 Fuzzers 执行许多投入以最大限度地增加达到的代码数量。 最近, 指导Greybox Fuzzers (DGFs) 提出了一个超越“ 公正” 覆盖范围的替代战略: 通过选择“ 更清洁” 种子, 将测试推向具体的代码目标。 DGF 经历了不同的阶段: 勘探( 到达有趣的地点) 和开发( 触发错误 ) ( 触发错误 ) 。 实际上, DGFs 利用了直接测量勘探的覆盖范围, 而开采的最好以不同目标之间的交替间接衡量。 具体地说, 我们观察到了现有 DGF 规模的两种限制:(i) 它们距离指标不够精确, 也就是说, 将多条路径和目标平均到一个分数( 决定哪个种子优先) ; DGF 以圆杆方式分配种子的能量, 但不调整目标的优先顺序( 彻底探索的目标应该降低 ) 。 我们提议FishFuzz, 将鱼Fu 的激励从拖网捕捞中得出灵感: 首先是网路, 将一个宽网路, 较宽的覆盖面比高覆盖面,, 然后缓慢地将种子的种子的种子的种子的精确的定位, 战略是构建一个核心到最接近一个核心的走向一个核心的顺序的走向最高级的战略, 。