CollAFL: Path Sensitive Fuzzing

By Shuitao Gan, Chao Zhang, Xiaojun Qin, Xuwen Tu, Kang Li, Zhongyu Pei, Zuoning Chen. IEEE Symposium on Security and Privacy, 2018

435 citations recorded by the source corpus.

Coverage-guided fuzzing is a widely used and effective solution to find software vulnerabilities. Tracking code coverage and utilizing it to guide fuzzing are crucial to coverage-guided fuzzers. However, tracking full and accurate path coverage is infeasible in practice due to the high instrumentation overhead. Popular fuzzers (e.g., AFL) often use coarse coverage information, e.g., edge hit counts stored in a compact bitmap, to achieve highly efficient greybox testing. Such inaccuracy and incompleteness in coverage introduce serious limitations to fuzzers. First, it causes path collisions, which prevent fuzzers from discovering potential paths that lead to new crashes. More importantly, it prevents fuzzers from making wise decisions on fuzzing strategies. In this paper, we propose a coverage sensitive fuzzing solution CollAFL. It mitigates path collisions by providing more accurate coverage information, while still preserving low instrumentation overhead. It also utilizes the coverage information to apply three new fuzzing strategies, promoting the speed of discovering new paths and vulnerabilities. We implemented a prototype of CollAFL based on the popular fuzzer AFL and evaluated it on 24 popular applications. The results showed that path collisions are common, i.e., up to 75% of edges could collide with others in some applications, and CollAFL could reduce the edge collision ratio to nearly zero. Moreover, armed with the three fuzzing strategies, CollAFL outperforms AFL in terms of both code coverage and vulnerability discovery. On average, CollAFL covered 20% more program paths, found 320% more unique crashes and 260% more bugs than AFL in 200 hours. In total, CollAFL found 157 new security bugs with 95 new CVEs assigned.

View Paper: https://www.semanticscholar.org/paper/241d22da3474774691b8fe92b79ccf1d74d225dc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

DeepHunter: a coverage-guided fuzz testing framework for deep neural networks (2019, methodology): “In traditional software, a typical CGF iteratively performs the following steps [17]: (1) Despite the large gap between traditional programs and DNNs, the success of CGF on traditional programs may still offer insights into the testing of DNNs. Intuitively, the target traditional program mirrors…”
Fuzzing: A Survey for Roadmap (2022, background): “Specifically, this implementation of obtaining edge coverage incurs the problem of edge collision; i.e., two different edges are assigned with the same identifier [66, 216].”
REDQUEEN: Fuzzing with Input-to-State Correspondence (2019, background): “COLLAFL [19] and INSTRIM [30] improve the performance of AFL, by decreasing the probability that two distinct paths are considered the same.”
The Art, Science, and Engineering of Fuzzing: A Survey (2018, background): “CollAFL [86] recently addressed this shortcoming by introducing a new path-sensitive hash function.”
Superion: Grammar-Aware Greybox Fuzzing (2018, unknown): “AFL [71], Steelix [43], FairFuzz [42] and CollAFL [23] use coverage to achieve the guidance, and SlowFuzz [52] and PerfFuzz [41] further use resource usage to realize the guidance.”
QSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing (2018, methodology): “Also, AFLFast [34] uses a Markov chain model to prioritize paths with low reachability, and CollAFL [36]”