FairFuzz: Targeting Rare Branches to Rapidly Increase Greybox Fuzz Testing Coverage

TL;DR

FairFuzz enhances greybox fuzz testing by prioritizing and mutating inputs to target rare program branches, significantly increasing coverage and testing efficiency over traditional AFL methods.

Contribution

It introduces a novel approach that automatically identifies rare program parts and adjusts input mutations to improve coverage in fuzz testing.

Findings

Significant coverage increases on certain benchmarks within 24 hours.

Faster achievement of high program coverage compared to AFL.

Effective targeting of rare branches improves fuzzing depth.

Abstract

In recent years, fuzz testing has proven itself to be one of the most effective techniques for finding correctness bugs and security vulnerabilities in practice. One particular fuzz testing tool, American Fuzzy Lop or AFL, has become popular thanks to its ease-of-use and bug-finding power. However, AFL remains limited in the depth of program coverage it achieves, in particular because it does not consider which parts of program inputs should not be mutated in order to maintain deep program coverage. We propose an approach, FairFuzz, that helps alleviate this limitation in two key steps. First, FairFuzz automatically prioritizes inputs exercising rare parts of the program under test. Second, it automatically adjusts the mutation of inputs so that the mutated inputs are more likely to exercise these same rare parts of the program. We conduct evaluation on real-world programs against state-of-the-art versions of AFL, thoroughly repeating experiments to get good measures of variability. We find that on certain benchmarks FairFuzz shows significant coverage increases after 24 hours compared to state-of-the-art versions of AFL, while on others it achieves high program coverage at a significantly faster rate.