ReFuzz: A Remedy for Saturation in Coverage-Guided Fuzzing

Abstract

Coverage-guided greybox fuzzing aims at generating random test inputs to trigger vulnerabilities in target programs while achieving high code coverage. In the process, the scale of testing gradually becomes larger and more complex, and eventually, the fuzzer runs into a saturation state where new vulnerabilities are hard to find. In this paper, we propose a fuzzer, ReFuzz, that acts as a complement to existing coverage-guided fuzzers and a remedy for saturation. This approach facilitates the generation of inputs that lead only to covered paths by omitting all other inputs, which is exactly the opposite of what existing fuzzers do. ReFuzz takes the test inputs generated from the regular saturated fuzzing process and continue to explore the target program with the goal of preserving the code coverage. The insight is that coverage-guided fuzzers tend to underplay already covered execution paths during fuzzing when seeking to reach new paths, causing covered paths to be examined insufficiently. In our experiments, ReFuzz discovered tens of new unique crashes that AFL failed to find, of which nine vulnerabilities were submitted and accepted to the CVE database.

AEMB: An Automated Exploit Mitigation Bypassing Solution

“…The construction of the exploit-mitigation bypassing constraints is mainly for the expressions between symbolic memory and concrete values. For example, the one-byte memory symbol expression at Targetmemory is shown in Equation (1).…”

“…With the advancement of cyber security, there is an increase in the study of software security, particularly software vulnerabilities [1][2][3]. Automated exploit generation (AEG) is one of the best ways to assess the exploitability of vulnerabilities and is drawing more and more attention.…”