一句话：提出 TransferFuzz，利用基础二进制历史轨迹引导目标二进制模糊测试，验证复用传播漏洞的可触发性及影响范围。
软件复用常使漏洞扩散，导致 CVE 报告受影响范围不精确。传统方法只能识别目标软件中复用的漏洞代码，无法验证漏洞在新上下文中能否触发，因而产生误报。本文提出 TransferFuzz：在基础漏洞二进制执行或模糊测试时收集运行时信息，提取历史轨迹；设计关键字节引导变异策略与嵌套模拟退火算法，将轨迹迁移到复用漏洞函数的目标二进制，实施轨迹引导模糊测试以验证传播漏洞。在公开数据集上的评估表明，TransferFuzz 能快速验证现有技术无法验证的漏洞，验证速度比现有方法快 2.5 至 26.2 倍，并将 15 个 CVE 的受影响二进制从 15 个扩展到 53 个。
Code reuse in software development frequently facilitates the spread of vulnerabilities, making the scope of affected software in CVE reports imprecise. Traditional methods primarily focus on identifying reused vulnerability code within target software, yet they cannot verify if these vulnerabilities can be triggered in new software contexts. This limitation often results in false positives. In this paper, we introduce TransferFuzz, a novel vulnerability verification framework, to verify whether vulnerabilities propagated through code reuse can be triggered in new software. Innovatively, we collected runtime information during the execution or fuzzing of the basic binary (the vulnerable binary detailed in CVE reports). This process allowed us to extract historical traces, which proved instrumental in guiding the fuzzing process for the target binary (the new binary that reused the vulnerable function). TransferFuzz introduces a unique Key Bytes Guided Mutation strategy and a Nested Simulated Annealing algorithm, which transfers these historical traces to implement trace-guided fuzzing on the target binary, facilitating the accurate and efficient verification of the propagated vulnerability. Our evaluation, conducted on widely recognized datasets, shows that TransferFuzz can quickly validate vulnerabilities previously unverifiable with existing techniques. Its verification speed is 2.5 to 26.2 times faster than existing methods. Moreover, TransferFuzz has proven its effectiveness by expanding the impacted software scope for 15 vulnerabilities listed in CVE reports, increasing the number of affected binaries from 15 to 53. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/TransferFuzz.
DOI 原文 ·
@inproceedings{paperbot8728,
title = {TransferFuzz: Fuzzing with Historical Trace for Verifying Propagated Vulnerability Code},
author = {Siyuan Li and Yuekang Li and Zuxin Chen and Chaopeng Dong and Yongpan Wang and Hong Li and Yongle Chen and Hongsong Zhu},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00061}
}