VUzzer: Application-aware Evolutionary Fuzzing

Abstract

Fuzzing is an effective software testing technique to find bugs. Given the size and complexity of real-world applications, modern fuzzers tend to be either scalable, but not effective in exploring bugs that lie deeper in the execution, or capable of penetrating deeper in the application, but not scalable. In this paper, we present an application-aware evolutionary fuzzing strategy that does not require any prior knowledge of the application or input format. In order to maximize coverage and explore deeper paths, we leverage control-and data-flow features based on static and dynamic analysis to infer fundamental properties of the application. This enables much faster generation of interesting inputs compared to an application-agnostic approach. We implement our fuzzing strategy in VUzzer and evaluate it on three different datasets: DARPA Grand Challenge binaries (CGC), a set of real-world applications (binary input parsers), and the recently released LAVA dataset. On all of these datasets, VUzzer yields significantly better results than state-of-the-art fuzzers, by quickly finding several existing and new bugs. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

Semantic Sensitive Coverage-based Fuzzing

“…Control flow and data flow features have been used to guide the fuzzing process [4] , while semantic features are rarely considered. We observe that some program operations are more likely to fail the program or introduce a vulnerability, while other operations are not.…”

“…Previous work has proved that better code coverage results in higher probability of finding bugs [5] . Thus, state-of-the-art fuzzers like AFL [7] and Vuzzer [4] employ a coverage-based fuzzing strategy. More specifically, program control flow is interpreted as a graph, and vertices are used to represent basic blocks, edges are used to represent transitions between the basic blocks.…”

“…However, it treats all newly discovered edges equally and select seeds in sequence, thus cannot select the most promising ones to mutate. AFLFast [3] and Vuzzer [4] improve the seed selection strategy to improve the efficiency or effectiveness of bug finding. AFLFast measures the frequency of all exercised paths, selects seeds that have been fuzzed fewer, and allocates more energy to seeds that exercise low-frequent paths.…”

Chemotactic Test Case Recombinationfor Large-Scale Fuzzing

“…The fuzzing discipline has evolved from its very beginnings [9] in 1990 to an active area of research providing advanced testing frameworks [1,2,11,14,15]. Beyond generational (format-aware) and mutational (format-blind) fuzzers we can generally distinguish between feedback-driven and black-box fuzzers.…”

“…Recent research focuses on advancing single fuzzers [2,11,15] and optimal scheduling of fuzzers, test case corpora, and targets during fuzzing campaigns [19]. But how can we optimize the interaction between fuzzers?…”