HGFuzzer: Directed Greybox Fuzzing via Large Language Model
TL;DR
HGFuzzer, an automated framework that augments DGF with predicate-guided execution synthesis, and successfully triggered 19 bugs, unearthed 9 previously unknown, CVE-assigned bugs, confirming its efficacy in real-world security auditing.
Abstract
Directed Greybox Fuzzing (DGF) aims to efficiently test specific code locations, but its effectiveness is often hampered by its reliance on a syntax-driven strategy. This approach leads to an intractable search space during exploration and inefficient, semantically unaware mutations during exploitation. To address these limitations, we introduce HGFuzzer, an automated framework that augments DGF with predicate-guided execution synthesis. HGFuzzer first infers the execution predicates required to traverse a feasible call chain to the target, and then uses these predicates as a shared specification for generating coordinated fuzzing components. Through semantic analysis of the code, it constructs a purpose-built harness to govern control flow, a target-reachable seed generator to materialize the required data constraints, and a constraint-aware mutator that preserves reachability conditions while mutating bug-triggering fields. Our evaluation of HGFuzzer on 23 real-world bugs demonstrates its superior performance. It successfully triggered 19 bugs, with 11 of them discovered in under 1,000 seconds, and achieved a speedup of at most 24.1 \(\times\) over state-of-the-art fuzzers. Furthermore, HGFuzzer unearthed 9 previously unknown, CVE-assigned bugs, confirming its efficacy in real-world security auditing.