To date, various hybrid fuzzers have been proposed for maximal program vulnerability exposure by integrating the power of fuzzing strategies and concolic executors. While the existing hybrid fuzzers have shown their superiority over conventional coverage-guided fuzzers, they seldom follow equivalent evaluation setups, e.g., benchmarks and seed corpora. Thus, there is a pressing need for a comprehensive study on the existing hybrid fuzzers to provide implications and guidance for future research in this area. To this end, in this paper, we conduct the first extensive study on state-of-the-art hybrid fuzzers. Surprisingly, our study shows that the performance of existing hybrid fuzzers may not well generalize to other experimental settings. Meanwhile, their performance advantages over conventional coverage-guided fuzzers are overall limited. In addition, instead of simply updating the fuzzing strategies or concolic executors, updating their coordination modes potentially poses crucial performance impact of hybrid fuzzers. Accordingly, we propose Cohuzz to improve the effectiveness of hybrid fuzzers by upgrading their coordination modes. Specifically, based on the baseline hybrid fuzzer QSYM, Cohuzz adopts \textit{edge-oriented scheduling} to schedule edges for applying concolic execution via an online linear regression model with Stochastic Gradient Descent. It also adopts \textit{sampling-augmenting synchronization} to derive seeds for applying fuzzing strategies via the interval path abstraction and John walk as well as incrementally updating the model. Our evaluation results indicate that Cohuzz can significantly increase the edge coverage (e.g., 16.31% higher than the best existing hybrid fuzzer in our study) and expose around 2X more unique crashes than all studied hybrid fuzzers. Moreover, Cohuzz successfully detects 37 previously unknown bugs where 30 are confirmed with 8 new CVEs and 20 are fixed.
Wed 17 MayDisplayed time zone: Hobart change
13:45 - 15:15 | Fuzzing: techniques and toolsTechnical Track / Journal-First Papers / SEIP - Software Engineering in Practice at Meeting Room 101 Chair(s): Mike Papadakis University of Luxembourg, Luxembourg | ||
13:45 7mTalk | Neural Network Guided Evolutionary Fuzzing for Finding Traffic Violations of Autonomous Vehicles Journal-First Papers Ziyuan Zhong Columbia University, Gail Kaiser Columbia University, Baishakhi Ray Columbia University | ||
13:52 15mTalk | Reachable Code Coverage Technical Track Danushka Liyanage Monash University, Australia, Marcel Böhme MPI-SP, Germany and Monash University, Australia, Kla Tantithamthavorn Monash University, Stephan Lipp Technical University of Munich | ||
14:07 15mTalk | Learning Seed-Adaptive Mutation Strategies for Greybox Fuzzing Technical Track | ||
14:22 15mTalk | Improving Java Deserialization Gadget Chain Mining via Overriding-Guided Object Generation Technical Track Sicong Cao Yangzhou University, Xiaobing Sun Yangzhou University, Xiaoxue Wu Yangzhou University, Lili Bo Yangzhou University, Bin Li Yangzhou University, Rongxin Wu Xiamen University, Wei Liu Nanjing University, Biao He Ant Group, Yu Ouyang Ant Group, Jiajia Li Ant Group | ||
14:37 15mTalk | Evaluating and Improving Hybrid Fuzzing Technical Track Ling Jiang Southern University of Science and Technology, Hengchen Yuan Southern University of Science and Technology, Mingyuan Wu Southern University of Science and Technology, Lingming Zhang University of Illinois at Urbana-Champaign, Yuqun Zhang Southern University of Science and Technology | ||
14:52 15mTalk | DAISY: Effective Fuzz Driver Synthesis with Object Usage Sequence Analysis SEIP - Software Engineering in Practice Mingrui Zhang Tsinghua University, Beijing, China, Chijin Zhou Tsinghua University, Jianzhong Liu ShanghaiTech University, Mingzhe Wang Tsinghua University, Jie Liang , Juan Zhu , Yu Jiang Tsinghua University |