Toward Unbiased Multiple-Target Fuzzing with Path Diversity

TL;DR

Directed fuzzing often fails to activate vulnerabilities due to PFA and PTA and exhibits bias in exploring multiple targets. AFLRun combines a target path-diversity metric with an unbiased energy assignment to ensure fair and effective exploration of all targets. The contributions include the first technique to jointly optimize path diversity and per-target fairness with virgin maps and critical-block propagation, implemented on AFL++ and AFLGo and evaluated on Magma and OSS-Fuzz. AFLRun outperforms state-of-the-art fuzzers and uncovers 29 zero-day vulnerabilities, including 8 CVEs, across four real-world programs.

Abstract

In this paper, we propose a novel directed fuzzing solution named AFLRun, which features target path-diversity metric and unbiased energy assignment. Firstly, we develop a new coverage metric by maintaining extra virgin map for each covered target to track the coverage status of seeds that hit the target. This approach enables the storage of waypoints into the corpus that hit a target through interesting path, thus enriching the path diversity for each target. Additionally, we propose a corpus-level energy assignment strategy that guarantees fairness for each target. AFLRun starts with uniform target weight and propagates this weight to seeds to get a desired seed weight distribution. By assigning energy to each seed in the corpus according to such desired distribution, a precise and unbiased energy assignment can be achieved. We built a prototype system and assessed its performance using a standard benchmark and several extensively fuzzed real-world applications. The evaluation results demonstrate that AFLRun outperforms state-of-the-art fuzzers in terms of vulnerability detection, both in quantity and speed. Moreover, AFLRun uncovers 29 previously unidentified vulnerabilities, including 8 CVEs, across four distinct programs.