Abstract:Greybox fuzzing is the de-facto standard to discover bugs during development. Fuzzers execute many inputs to maximize the amount of reached code. Recently, Directed Greybox Fuzzers (DGFs) propose an alternative strategy that goes beyond "just" coverage: driving testing toward specific code targets by selecting "closer" seeds. DGFs go through different phases: exploration (i.e., reaching interesting locations) and exploitation (i.e., triggering bugs). In practice, DGFs leverage coverage to directly measure exploration, while exploitation is, at best, measured indirectly by alternating between different targets. Specifically, we observe two limitations in existing DGFs: (i) they lack precision in their distance metric, i.e., averaging multiple paths and targets into a single score (to decide which seeds to prioritize), and (ii) they assign energy to seeds in a round-robin fashion without adjusting the priority of the targets (exhaustively explored targets should be dropped). We propose FishFuzz, which draws inspiration from trawl fishing: first casting a wide net, scraping for high coverage, then slowly pulling it in to maximize the harvest. The core of our fuzzer is a novel seed selection strategy that builds on two concepts: (i) a novel multi-distance metric whose precision is independent of the number of targets, and (ii) a dynamic target ranking to automatically discard exhausted targets. This strategy allows FishFuzz to seamlessly scale to tens of thousands of targets and dynamically alternate between exploration and exploitation phases. We evaluate FishFuzz by leveraging all sanitizer labels as targets. Extensively comparing FishFuzz against modern DGFs and coverage-guided fuzzers shows that FishFuzz reached higher coverage compared to the direct competitors, reproduces existing bugs (70.2% faster), and finally discovers 25 new bugs (18 CVEs) in 44 programs.

A Lightweight and High-Precision Approach for Bulky JavaScript Engines Fuzzing

Evaluating seed selection for fuzzing JavaScript engines

JSTIFuzz: Type-Inference-based JavaScript Engine Fuzzing

FUZZILLI: Fuzzing for JavaScript JIT Compiler Vulnerabilities

JIT-Picking: Differential Fuzzing of JavaScript Engines

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

FuzzCoder: Byte-level Fuzzing Test via Large Language Model

CovRL: Fuzzing JavaScript Engines with Coverage-Guided Reinforcement Learning for LLM-based Mutation

Fuzzing JavaScript Engines with a Syntax-Aware Neural Program Model

LAFuzz: Neural Network for Efficient Fuzzing

Large Language Model assisted Hybrid Fuzzing

Target Program Select Test Input Trim Test Input Mutate Test Input Execute Program Update Queue Instrument Program Grammar

Industrial Oriented Evaluation of Fuzzing Techniques

Engineering a Better Fuzzer with Synergically Integrated Optimizations.

ApproxiFuzzer: Fuzzing towards Deep Code Snippets in Java Programs

FishFuzz: Throwing Larger Nets to Catch Deeper Bugs

FuzzFactory: domain-specific fuzzing with waypoints

CKGFuzzer: LLM-Based Fuzz Driver Generation Enhanced By Code Knowledge Graph

RIFF: Reduced Instruction Footprint for Coverage-Guided Fuzzing

Path Sensitive Fuzzing for Native Applications

SLF: fuzzing without valid seed inputs