Paper Info
Title
Directed Greybox Fuzzing.
Abstract
Existing Greybox Fuzzers (GF) cannot be effectively directed, for instance, towards problematic changes or patches, towards critical system calls or dangerous locations, or towards functions in the stack-trace of a reported vulnerability that we wish to reproduce. In this paper, we introduce Directed Greybox Fuzzing (DGF) which generates inputs with the objective of reaching a given set of target program locations efficiently. We develop and evaluate a simulated annealing-based power schedule that gradually assigns more energy to seeds that are closer to the target locations while reducing energy for seeds that are further away. Experiments with our implementation AFLGo demonstrate that DGF outperforms both directed symbolic-execution-based whitebox fuzzing and undirected greybox fuzzing. We show applications of DGF to patch testing and crash reproduction, and discuss the integration of AFLGo into Google's continuous fuzzing platform OSS-Fuzz. Due to its directedness, AFLGo could find 39 bugs in several well-fuzzed, security-critical projects like LibXML2. 17 CVEs were assigned.
Year
DOI
Venue
2017
10.1145/3133956.3134020
CCS
Keywords
DocType
ISBN
patch testing, crash reproduction, reachability, directed testing, coverage-based greybox fuzzing, verifying true positives
Conference
978-1-4503-4946-8
Citations 
PageRank 
References 
56
1.74
23
Authors
4
Name
Order
Citations
PageRank
Marcel Böhme123114.95
Van-Thuan Pham21045.35
Manh-Dung Nguyen3692.53
Abhik Roychoudhury42449122.18