PatchFuzz: An Efficient Way to Incorporate Patching With Hybrid Fuzzing

Hybrid and patching-based fuzzing methods offer promise in uncovering software bugs using concolic execution and program transformation techniques. However, current implementations face efficiency challenges from three main factors. First, the efficacy of hybrid fuzzing can be compromised due to disruptions introduced during the mutation of inputs generated by concolic execution, hindering vulnerability discovery. Second, the speed and throughput of the underlying fuzzer significantly impact the effectiveness of both methods. Third, patching-based fuzzing has an inefficient patching system and high analysis costs. Nonetheless, hybrid and patching-based fuzzing offer complementary strengths that can enhance overall efficacy. For instance, patching can maintain exploration depth by reducing the likelihood of input structure disruption, while concolic execution can authenticate detected crashes. In this paper, we present PATCHFUZZ, which integrates fuzzing and patching at a fundamental level, leveraging concolic execution to augment the fuzzing process. Specifically, PATCHFUZZ binds patching addresses with each seed rather than the program itself, promoting frequent interactions between patching and fuzzing. Additionally, we've devised efficient methodologies for patching information management and patched program switching. Evaluation on LAVA-M, CGC and OSS-Fuzz datasets shows PATCHFUZZ surpasses state-of-the-art fuzzers like QSYM, SYMQEMU, AFL++ CmpLog and T-Fuzz. Deployed on industrial devices, PATCHFUZZ uncovered 9 new vulnerabilities.