Abstract:Directed grey-box fuzzing (DGF) is a security testing technique that aims to steer the fuzzer towards predefined target sites in the program. To gain directedness, DGF prioritizes the seeds whose execution traces are closer to the target sites. Therefore, evaluating the distance between the execution trace of a seed and the target sites (aka, the seed distance) is important for DGF. The first directed grey-box fuzzer, AFLGo, uses an approach of calculating the basic block level distances during static analysis and accumulating the distances of the executed basic blocks to compute the seed distance. Following AFLGo, most of the existing state-of-the-art DGF techniques use all the basic blocks on the execution trace and only the control flow information for seed distance calculation. However, not every basic block is equally important and there are certain basic blocks where the execution trace starts to deviate from the target sites (aka, deviation basic blocks). In this paper, we propose a technique called WINDRANGER which leverages deviation basic blocks to facilitate DGF. To identify the deviation basic blocks, WINDRANGER applies both static reachability analysis and dynamic filtering. To conduct directed fuzzing, WINDRANGER uses the deviation basic blocks and their related data flow information for seed distance calculation, mutation, seed prioritization as well as explore-exploit scheduling. We evaluated WINDRANGER on 3 datasets consisting of 29 programs. The experiment results show that WINDRANGER outperforms AFLGo, AFL, and FAIRFUZZ by reaching the target sites 21%, 34%, and 37% faster and detecting the target crashes 44%, 66%, and 77% faster respectively. Moreover, we found a 0-day vulnerability with a CVE ID assigned in ffmpeg (a popular multimedia library extensively fuzzed by OSS-fuzz) with WINDRANGER by supplying manually identified suspect locations as the target sites.

Vulnerable Region-Aware Greybox Fuzzing.

Energy distribution matters in greybox fuzzing

WolfFuzz: A Dynamic, Adaptive, and Directed Greybox Fuzzer

V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing

Smart Greybox Fuzzing

Coverage-based Greybox Fuzzing as Markov Chain

Greybox Fuzzing of Distributed Systems

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

Improving Grey-Box Fuzzing by Modeling Program Behavior

DeepFuzzer: Accelerated Deep Greybox Fuzzing

AFL++: A Vulnerability Discovery and Reproduction Framework

FairFuzz: a targeted mutation strategy for increasing greybox fuzz testing coverage

Model-Based Grey-Box Fuzzing of Network Protocols

ISC4DGF: Enhancing Directed Grey-box Fuzzing with LLM-Driven Initial Seed Corpus Generation

Evolutionary Mutation-based Fuzzing as Monte Carlo Tree Search

NESTFUZZ: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic

Better Pay Attention Whilst Fuzzing.

Fuzzing with Quantitative and Adaptive Hot-Bytes Identification

GREYONE: Data Flow Sensitive Fuzzing

WINDRANGER: A Directed Greybox Fuzzer driven by Deviation Basic Blocks

V-Fuzz: Vulnerability Prediction-Assisted Evolutionary Fuzzing for Binary Programs