Visible to the public T-Fuzz: Fuzzing by Program Transformation

TitleT-Fuzz: Fuzzing by Program Transformation
Publication TypeConference Paper
Year of Publication2018
AuthorsPeng, H., Shoshitaishvili, Y., Payer, M.
Conference Name2018 IEEE Symposium on Security and Privacy (SP)
Date Publishedmay
Keywordsbug finding, code paths, composability, Computer bugs, coverage-guided fuzzer, deep execution paths, dynamic tracing based technique, Fuzz, fuzzer-generated inputs, fuzzing, fuzzing transformed programs, input checks, input mutation techniques, Libraries, Metrics, program analysis, program debugging, program diagnostics, program testing, program transformation, program verification, pubcrawl, randomly generated inputs, security, security of data, Software, software bugs, symbolic execution-based approach, t-fuzz approach, taint analysis, Tools
AbstractFuzzing is a simple yet effective approach to discover software bugs utilizing randomly generated inputs. However, it is limited by coverage and cannot find bugs hidden in deep execution paths of the program because the randomly generated inputs fail complex sanity checks, e.g., checks on magic values, checksums, or hashes. To improve coverage, existing approaches rely on imprecise heuristics or complex input mutation techniques (e.g., symbolic execution or taint analysis) to bypass sanity checks. Our novel method tackles coverage from a different angle: by removing sanity checks in the target program. T-Fuzz leverages a coverage-guided fuzzer to generate inputs. Whenever the fuzzer can no longer trigger new code paths, a light-weight, dynamic tracing based technique detects the input checks that the fuzzer-generated inputs fail. These checks are then removed from the target program. Fuzzing then continues on the transformed program, allowing the code protected by the removed checks to be triggered and potential bugs discovered. Fuzzing transformed programs to find bugs poses two challenges: (1) removal of checks leads to over-approximation and false positives, and (2) even for true bugs, the crashing input on the transformed program may not trigger the bug in the original program. As an auxiliary post-processing step, T-Fuzz leverages a symbolic execution-based approach to filter out false positives and reproduce true bugs in the original program. By transforming the program as well as mutating the input, T-Fuzz covers more code and finds more true bugs than any existing technique. We have evaluated T-Fuzz on the DARPA Cyber Grand Challenge dataset, LAVA-M dataset and 4 real-world programs (pngfix, tiffinfo, magick and pdftohtml). For the CGC dataset, T-Fuzz finds bugs in 166 binaries, Driller in 121, and AFL in 105. In addition, found 3 new bugs in previously-fuzzed programs and libraries.
DOI10.1109/SP.2018.00056
Citation Keypeng_t-fuzz:_2018