SAND: Decoupling Sanitization from Fuzzing for Low Overhead
<|reference_start|>SAND: Decoupling Sanitization from Fuzzing for Low Overhead: Sanitizers provide robust test oracles for various software vulnerabilities. Fuzzing on sanitizer-enabled programs has been the best practice to find software bugs. Since sanitizers need to heavily instrument a target program to insert run-time checks, sanitizer-enabled programs have much higher overhead compared to normally built programs. In this paper, we present SAND, a new fuzzing framework that decouples sanitization from the fuzzing loop. SAND performs fuzzing on a normally built program and only invokes sanitizer-enabled programs when input is shown to be interesting. Since most of the generated inputs are not interesting, i.e., not bug-triggering, SAND allows most of the fuzzing time to be spent on the normally built program. To identify interesting inputs, we introduce execution pattern for a practical execution analysis on the normally built program. We realize SAND on top of AFL++ and evaluate it on 12 real-world programs. Our extensive evaluation highlights its effectiveness: on a period of 24 hours, compared to fuzzing on ASan/UBSan-enabled and MSan-enabled programs, SAND respectively achieves 2.6x and 15x throughput and detects 51% and 242% more bugs.<|reference_end|>
@article{kong2024sand:,
    title={SAND: Decoupling Sanitization from Fuzzing for Low Overhead},
    author={Ziqiao Kong, Shaohua Li, Heqing Huang, Zhendong Su},
    journal={arXiv preprint arXiv:2402.16497},
    year={2024},
    archivePrefix={arXiv},
    eprint={2402.16497},
    primaryClass={cs.CR cs.SE}
}