ArgvFuzz: Argv-Sensitive Multi-Target Directed Greybox Fuzzing

Multi-target directed greybox fuzzing plays a crucial role in discovering software vulnerabilities by guiding fuzzers to explore specific program paths and achieving multiple targets in a single test. However, even the most advanced fuzzing techniques still fail to reach certain targets. These targets may require specific argvs (argument vectors, also known as command-line options) to reach. Different argvs will guide the exploration towards different program branches, allowing the program to reach previously untouched paths and targets that were previously unreachable. In this paper, we introduce ArgvFuzz, a novel argv-sensitive multi-target directed greybox fuzzing approach. ArgvFuzz extends the input space of multi-target directed greybox fuzzing by incorporating argvs and proposes an argv prioritization method based on distance and coverage metrics to guide the fuzzing process towards specific targets while dynamically adjusting argvs. We conducted a comprehensive evaluation of ArgvFuzz using sanitizer's labels as targets and compared its performance with some of the most advanced multi-target directed fuzzers. Our evaluation results indicate that ArgvFuzz significantly outperforms the baseline across multiple metrics. Specifically, it achieves an average of 15.67% higher coverage, a 16.23% increase in target reach, and a 3.3-fold improvement in crash-triggering capability. We have also successfully obtained a CVE ID: CVE-2024-42656.