One Mutation Fits All: Exploring Universal Library Fuzzing Based on Exogenous Mutation

Fuzzing is a critical technique for uncovering vulnerabilities in software libraries. However, current approaches often struggle with cross-language compatibility and integration with diverse fuzzing tools. We propose <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EXo-Muta</monospace>, a novel universal library fuzzing framework based on exogenous mutation. We use the term ‘exogenous’ to describe this new mutation process because it operates externally to the fuzzer's core engine, executing within the fuzz driver as an independent component, unlike traditional endogenous mutations tightly integrated within the fuzzer itself. By decoupling the mutation process from specific fuzzers, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EXo-Muta</monospace> achieves unprecedented adaptability across diverse programming languages and fuzzing tools. It leverages static analysis to extract structured data representations and applies language-independent mutation operators at the code level. This design enables seamless integration with various existing fuzzers, enhancing their performance regardless of the target language. We further utilize large language models (LLM) for efficient cross-language data conversion. In experiments, we evaluated <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EXo-Muta</monospace> on 20 real-world libraries across C++, Python, Java, and JavaScript, integrating it with multiple stateof- the-art fuzzers, such as AFL++ and libFuzzer, and languagespecific tools, such as Atheris and Jazzer. Results show significant improvements in code coverage across different fuzzers and languages, with up to 58% more edges discovered in C++ projects when integrated with libFuzzer, and consistent outperformance in other scenarios (27% on Python, 9% on Java, 6% on JavaScript). <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">EXo-Muta</monospace> represents a significant advancement in fuzzing technology, offering a universal, language-agnostic approach that substantially improves code coverage across diverse programming languages and fuzzing tools, thereby expanding the reach and effectiveness of library API testing.