P-Fuzz: A Parallel Grey-Box Fuzzing Framework

Abstract

Fuzzing is an effective technology in software testing and security vulnerability detection. Unfortunately, fuzzing is an extremely compute-intensive job, which may cause thousands of computing hours to find a bug. Current novel works generally improve fuzzing efficiency by developing delicate algorithms. In this paper, we propose another direction of improvement in this field, i.e., leveraging parallel computing to improve fuzzing efficiency. In this way, we develop P-fuzz, a parallel fuzzing framework that can utilize massive, distributed computing resources to fuzz. P-fuzz uses a database to share the fuzzing status such as seeds, the coverage information, etc. All fuzzing nodes get tasks from the database and update their fuzzing status to the database. Also, P-fuzz handles some data races and exceptions in parallel fuzzing. We compare P-fuzz with AFL and a parallel fuzzing framework Roving in our experiment. The result shows that P-fuzz can easily speed up AFL about 2.59× and Roving about 1.66× on average by using 4 nodes.

Facilitating Parallel Fuzzing with mutually-exclusive Task Distribution

“…Depending on the number of instances we launch, we can averagely reduce 57.1% -60.3% of the overlaps and bring a 9.5% -10.2% increase in code coverage with AFL. Our evaluation also demonstrates that, compared to the state-of-the-art solutions of improving parallel fuzzing [22,39], our solution not only brings higher improvement to efficiency of edge coverage but also better preserves the capacity of the fuzzing tools. As a side benefit, AFL-EDGE triggers over 6K unique crashes, corresponding to 14 new bugs.…”

“…We run AFL as the baseline of our evaluation. To compare AFL-EDGE with the existing solutions, we also run P-FUZZ [39] and PAFL [22] on top of AFL. Because the implementations of P-FUZZ and PAFL are not publicly available, we re-implemented the two solutions following the algorithms presented in their publications [39,22].…”

“…In the literature, two solutions of improving parallel fuzzing, P-FUZZ [39] and PAFL [22], fit into our model. Both P-FUZZ and PAFL consider a fuzzing task is to run a round of mutations to a unique seed and they distribute a similar amount of unique seeds to each instance.…”

“…This line of efforts facilitates parallel fuzzing from a system perspective, which is orthogonal to our approach. Following the other line, P-FUZZ [39], PAFL [22] and Ye et al [47] propose to distribute fuzzing tasks to different instances to avoid overlaps. We omit the details of P-FUZZ and PAFL since they have been discussed in § 4 and evaluated in § 6.…”

UltraFuzz: Towards Resource-Saving in Distributed Fuzzing

“…Then, the researcher takes a step further by sharing seeds between fuzzer instances. In this mode, the program starts to schedule tasks between fuzzing instances to alleviate task conflicts [32,33]. To optimize parallel fuzzing towards resource-saving, we still need to overcome the following technical challenges.…”