Daisy: Effective Fuzz Driver Synthesis with Object Usage Sequence Analysis
Mingrui Zhang, Chijin Zhou, Jianzhong Liu, Mingzhe Wang, Jie Liang, Juan Zhu, Yu Jiang · 2023
Fuzzing is increasingly used in industrial settings for vulnerability detection due to its scalability and effectiveness. Libraries require driver programs to feed the fuzzer-generated inputs into library-provided interfaces. Writing such drivers manually is tedious and error-prone, thus greatly hindering the widespread use of fuzzing in practical situations. Previous attempts at automatic driver synthesis perform static analysis on the libraries and their consumers. However, a lack of dynamic object usage information renders them ineffective at generating interface function calls with correct parameters and meaningful sequences. This severely limits fuzzing’s bug-finding capabilities and can produce faulty drivers.In this paper, we propose Daisy, a driver synthesis framework, which extracts dynamic object usage sequences of library consumers to synthesize significantly more effective drivers. Daisy uses the following two steps to synthesize a fuzz driver for a library. First, it models each object’s behaviors into an object usage sequence during the execution of its consumers. Next, it merges all the extracted sequences and constructs a series of interface calls with valid object usages based on the merged sequence. We implemented Daisy and evaluated its effectiveness on real-world libraries selected from both the Android Open Source Project (AOSP) and Google’s FuzzBench. Daisy’s synthesized drivers significantly outperform drivers produced by other state-of-the-art fuzz driver synthesizers. In addition, on applying Daisy to the latest versions of those extensively-fuzzed real-world libraries of the benchmark, e.g. libaom and freetype2, we also found 9 previously-unknown bugs with 3 CVEs assigned.