CherryPicker: A Parallel Solving and State Sharing Hybrid Fuzzing System

Abstract

<p>Hybrid testing, combining fuzz testing and concolic execution, has emerged as an effective technique for bug discovery. However, concolic execution becomes the performance bottleneck when applied to real-world software. Despite numerous approaches to optimize seed scheduling, symbolic simulation, and constraint solving, concolic execution remains inefficient and ineffective due to two limitations. First, the concolic executor and fuzzer do not synchronize the testing state in real time, leading to the generation of numerous duplicate inputs in both concolic execution and the fuzzer. Second, the concolic executor overlooks the independence of constraint solving and solves constraints sequentially, which introduces significant slowdown. In this paper, we first conduct a study to identify these limitations in existing hybrid testing systems. We then propose a novel design for hybrid fuzzing, CherryPicker, where the fuzzer and concolic executor share testing states, and concolic execution runs in parallel mode. Finally, we evaluate our system using the LAVA-M benchmark and real-world software and compare it to state-of-the-art systems. The results demonstrate that CherryPicker outperforms current systems in terms of efficiency and effectiveness, delivering improved runtime performance, generating more intriguing inputs, and activating more code. Notably, CherryPicker exclusively uncovers six previously unknown bugs during the evaluation, which have been reported to developers, all of which have been confirmed with three CVEs assigned.</p>