Field-aware Evolutionary Fuzzing Based on Input Specifications and Vulnerability Metrics

Evolutionary fuzzing technology based on genetic algorithm has become one of the most effective vulnerability discovery techniques due to its fast and scalable advantages. How to effectively mutate the seed input plays a crucial role in improving the efficiency of the fuzzing. A good mutation strategy can increase code coverage and vulnerability triggering probability. Existing fuzzing tools generally focus on how to mutate smartly to improve code coverage to find more vulnerabilities (such as passing the branch with magic bytes), but they still face two challenges which substantially reduces the efficiency of vulnerability discovery. First, the input space is huge and current fuzzers are not aware of the input format, resulting in many mutated inputs are invalid. Second, they believe all bytes are equal and mutate them sequentially, wasting lots of time testing some uninteresting bytes. To this end, this paper proposes a field-aware mutation strategy that can find more vulnerabilities by generating fewer but more effective inputs. Specifically, we extract the field and type information of the seed input through the existing input specifications to ensure that the mutation is performed in field level instead of byte level and the optimal mutation strategy is selected. At the same time, the input fields are scored by code assessment based on vulnerability metrics, thus the more important fields (i.e., fields that are more likely to trigger the vulnerability) are prioritized to be mutated. We implemented a prototype tool, FaFuzzer, and evaluated it on two different datasets consisting of a variety of real-world applications. Experiments show that our field-aware strategy can find more vulnerabilities with fewer inputs than existing tools, while maintaining high code coverage. We found many unknown bugs in five widely used real-world applications and reported them to the relevant vendors.

I. Introduction

With the outbreak of many attack events such as Heartbleed attack [1], WanaCry ransomware [2], people’s property and privacy have been greatly threatened. The reason behind them is that vulnerabilities existed in the related software can lead to control flow hijacking or information leakage. Therefore, eliminating software vulnerabilities becomes critical. Fuzzing is currently the most popular and effective technology for discovering software vulnerabilities and bugs. It has been used to discover a large number of high-impact security vulnerabilities, such as CVE-2014-0160 [3], CVE-2017-7668 [4] and so on. Its idea is to generate some semi-valid input to trigger some anomalous behavior in software by mutating a set of initial inputs according to some specified strategies. In terms of ways of sample generation, it is divided into generation-based fuzzing and mutation-based fuzzing. The generation-based fuzzer (eg. Peach [5]) relies on the syntax for describing the input structure to generate test cases. Its advantage is that it can generate correctly formatted samples, to avoid being discarded early in the parsing stage of the program, which can guarantee to trigger some deep code. But it needs to manually write a syntax file such as Peach Pit, which is time consuming and error-prone, and it has no coverage feedback mechanism, which also limits its ability to explore code. Mutation-based fuzzing (eg. AFL [6]) does not rely on input syntax and randomly mutate the initial seed inputs to generate new test cases. This method is convenient and easy to use, but because it is lack of the input structure awareness, resulting in generating a lot of invalid input and wasting a lot of time.