Rust and Go directed fuzzing with LibAFL-DiFuzz

Directed fuzzing for Rust and Go applications is introduced through a novel approach utilizing LibAFL-DiFuzz, which addresses the need for precise testing solutions beyond traditional coverage-guided methods. This work expands directed fuzzing applicability to Rust and Go by proposing advanced preprocessing techniques, compiler customizations, and graph construction/instrumentation methods tailored specifically for these languages. The implemented tools demonstrate competitive advantages over existing fuzzers like afl.rs, cargo-fuzz, and go-fuzz when measured by Time to Exposure (TTE) experiments.

Contributions

The paper makes several key contributions to the field of directed fuzzing for Rust and Go:

1. A novel approach is proposed to enable directed fuzzing of Rust and Go applications, which includes generic functions handling at preprocessing stage for Rust, rustc compiler customization for Rust directed fuzzing, and a combined approach to graph construction with correct debug information based on AST and SSA IR for Go code.

2. The first Rust and Go directed fuzzing tools are implemented based on the LibAFL-DiFuzz backend.

3. The tools are evaluated against popular existing fuzzers using the Time to Exposure (TTE) metric, showing that Rust-LibAFL-DiFuzz outperforms other tools by the best TTE result.

4. For Go, Go-LibAFL outperforms its opponent by the best and, in the majority of cases, by average result, with two cases showing orders of magnitude difference.

Directed Fuzzing Approach (LibAFL-DiFuzz)

The directed fuzzing approach implemented in LibAFL-DiFuzz involves a four-step process to prepare the target for directed fuzzing:

1. Static analysis to obtain enhanced target sequences (ETS) – the lists of basic blocks leading to target points with computed context weights.

2. Target program instrumentation based on the ETS obtained in the previous step, which is referred to as implementation of ETS feedback.

3. SanCov instrumentation for coverage feedback.

4. Linking with the libforkserver library, which contains all required utilities for fuzzing.

The generalized pipeline involves inserting code that writes target basic blocks unique IDs to an ETS shared memory and calling a function like libafl start forkserver at the beginning of the program. SanCov instrumentation inserts calls like sanitizer cov trace pc guard into all possible basic blocks to provide coverage guidance.

Rust Directed Fuzzing

Building fuzzing targets for Rust is conceptually similar to C/C++ but requires specific modifications due to Rust's compilation based on the LLVM toolchain. The process involves:

1. Adapting the DiFuzz static preprocessing tool, referred to as DiFuzz-Rust, which uses LLVM IR and debug information from LLVM-passes to build Call Graphs (CGs) and Control Flow Graphs (CFGs).

2. Modifying the rustc compiler itself to instrument the code, resulting in a customized compiler called libafl rustc.

3. Applying specific arguments to the custom compiler, such as “-C opt-level=0” to disable optimization, and passes like “-C passes=difuzz-etspass” for ETS feedback instrumentation and “-C passes=sancovmodule-C llvm-args=-sanitizer-coverage-level=3-C llvm-args=-sanitizer-coverage-trace-pcguard” for SanCov instrumentation.

Go Directed Fuzzing

The approach to supporting Go projects differs significantly because Go compilation relies on its own intermediate representation (IR) called SSA IR, rather than the LLVM toolchain. The implementation involves:

1. Implementing a DiFuzz-Go library to construct graphs and obtain debug information for functions and basic blocks using native Go libraries such as “go/ast,” “go/ssa,” and “go/cfg.”

2. A combined approach for graph construction: first, a Call Graph (CG) is constructed using SSA IR, followed by CFGs for each function in the graph to collect unified debug information.

3. Conversion of the resulting graphs to a DOT format compatible with the DiFuzz tool using a special formatter that traverses the graph in depth.

4. Instrumentation is performed at the source code level rather than at an intermediate representation level, using libraries like “go/ast” to insert high-level commands and function calls, such as “InstrumentETS(ID)” for ETS feedback and “SancovGuard(ID)” for coverage feedback.

Evaluation Results

The tools were evaluated using the Time to Exposure (TTE) metric across various projects in Rust (e.g., goblin, gdb-command) and Go (e.g., ollama, image-go).

Based on the provided scientific paper, here are specific improvements that could be made to AI systems, along with what those improved systems could achieve:

The core contribution of this research is a novel directed fuzzing framework (LibAFL-DiFuzz) specifically tailored for Rust and Go applications. Applying these techniques to AI/ML systems would yield significant improvements in their robustness, security, and verification.

Here are the specific improvements:

1. Replacement of traditional coverage-guided fuzzing with the proposed LibAFL-DiFuzz directed greybox fuzzing approach for models implemented in Rust or Go (e.g., inference engines, custom ML kernels).

2. Integration of advanced preprocessing techniques and compiler customizations (like those described in Section 4 and 5) to build highly accurate call graphs and control flow graphs from the target language's specific IR (LLVM for Rust, SSA IR for Go).

3. Implementation of source-code level instrumentation (ETS and SanCov feedback) that directly injects unique identifiers into the fuzzer's shared memory based on identified target basic blocks, rather than relying solely on intermediate representation feedback.

The improved AI systems could achieve the following specific capabilities:

1. Enhanced Robustness Against Adversarial Attacks:

2. Improved Vulnerability Detection in ML Infrastructure:

3. More Efficient Model Verification and Testing:

4. Faster Discovery of Edge Cases in Complex Systems:

The specific benefits for these improved AI systems are detailed below:

1. When applied to AI inference engines or custom model kernels written in Rust or Go, the system can be rigorously tested against targeted failure modes (like specific data handling logic, memory corruption paths, or control flow vulnerabilities) that are often missed by general fuzzers. This prevents catastrophic failures during deployment in production environments where robustness is paramount.

2. For AI systems where the core logic is implemented in Go (e.g., serving infrastructure), this method allows for precise targeting of critical functions (like input parsing, decision-making loops, or resource allocation) to discover bugs with significantly higher speed and accuracy than existing tools like go-fuzz. This means the system can be verified much faster before being deployed as a production service.

3. For model development pipelines in Rust, the ability to precisely target specific code paths (via ETS feedback) allows researchers to reproduce crashes or errors related to specific mathematical operations or data transformations within the model execution logic, leading to quicker debugging cycles and more reliable model training/refinement.

4. The overall efficiency gains demonstrated by LibAFL-DiFuzz (outperforming competitors in TTE experiments) mean that AI teams can spend less time running long, inefficient fuzzing campaigns and more time focusing on developing new features or improving the model itself, leading to a faster iteration cycle for secure AI development.

In modern SSDLC, program analysis and automated testing are essential for minimizing vulnerabilities before software release, with fuzzing being a fast and widely used dynamic testing method. However, traditional coverage-guided fuzzing may be less effective in specific tasks like verifying static analysis reports or reproducing crashes, while directed fuzzing, focusing on targeted program locations using proximity metrics, proves to be more effective. Some of the earliest directed fuzzers are, for example, AFLGo and BEACON, which use different proximity metric approaches. Although most automated testing tools focus on C/C++ code, the growing popularity of Rust and Go causes the need for precise and efficient testing solutions for these languages. This work expands the applicability of directed fuzzing beyond traditional analysis of C/C++ software. We present a novel approach to directed greybox fuzzing tailored specifically for Rust and Go applications. We introduce advanced preprocessing techniques, rustc compiler customizations, and elaborate graph construction and instrumentation methods to enable effective targeting of specific program locations. Our implemented fuzzing tools, based on LibAFL-DiFuzz backend, demonstrate competitive advantages compared to popular existing fuzzers like afl. rs, cargo-fuzz, and go-fuzz. According to TTE (Time to Exposure) experiments, Rust-LibAFL-DiFuzz outperforms other tools by the best TTE result. Some stability issues can be explained by different mutation approaches. Go-LibAFL-DiFuzz outperforms its opponent by the best and, in the majority of cases, by average result, having two cases with orders of magnitude difference. These results prove better efficiency and accuracy of our approach.