These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Directed greybox fuzzing (DGF) focuses on efficiently reaching specific
program locations or triggering particular behaviors, making it essential for
tasks like vulnerability detection and crash reproduction. However, existing
methods often suffer from path explosion and randomness in input mutation,
leading to inefficiencies in exploring and exploiting target paths. In this
paper, we propose HGFuzzer, an automatic framework that leverages the large
language model (LLM) to address these challenges. HGFuzzer transforms path
constraint problems into targeted code generation tasks, systematically
generating test harnesses and reachable inputs to reduce unnecessary
exploration paths significantly. Additionally, we implement custom mutators
designed specifically for target functions, minimizing randomness and improving
the precision of directed fuzzing. We evaluated HGFuzzer on 20 real-world
vulnerabilities, successfully triggering 17, including 11 within the first
minute, achieving a speedup of at least 24.8x compared to state-of-the-art
directed fuzzers. Furthermore, HGFuzzer discovered 9 previously unknown
vulnerabilities, all of which were assigned CVE IDs, demonstrating the
effectiveness of our approach in identifying real-world vulnerabilities.
External Datasets
CVE vulnerabilities sourced from prior fuzzing research and OSS-Fuzz