Fuzzing Acceleration for Memory Safety Bug Discovery with Slicer

Memory safety bugs are major threats to software because they occupy 65%-70% of severe security bugs. Consequently, researchers have introduced directed fuzzers and directed coverage-guided fuzzers, which can target memory safety bugs. However, they waste much time testing uninteresting code that may not contain memory safety bugs. In this paper, we propose Slicer, a program slicing technique, to accelerate directed fuzzing targeting memory safety bugs. The key idea is to remove as many code snippets irrelevant to memory safety bugs from target programs as possible to minimize uninteresting code execution. For that, Slicer first identifies and keeps the code snippets, such as memory access code, memory management code (e.g., malloc), and relevant control flow statements, that potentially violate memory safety. Next, Slicer identifies and keeps extra code snippets, such as program initialization code, that are required to run programs. Finally, Slicer removes the other code snippets. This approach is beneficial to directed fuzzers when they target memory safety bugs because Slicer can improve performance orthogonal to the points that directed fuzzers improve. We evaluate Slicer with 24 programs and found ten new bugs with seven CVEs. Furthermore, Slicer accelerates program execution speed 1.61× faster. Moreover, Slicer shows 1.52× improved testing coverage for code relevant to memory safety bugs when integrated with directed coverage-guided and coverage-guided fuzzers, ParmeSan and Darwin. Finally, integrating Slicer with three directed fuzzers, AFLGo, WindRanger, and SelectFuzz shows 1.64× faster memory safety bug discovery than those fuzzers without Slicer.