Search papers, labs, and topics across Lattice.
This paper introduces BULLSEYE, a Directed Greybox Fuzzing framework that enhances firmware vulnerability detection by targeting specific binary locations at the basic-block level. By integrating static and dynamic analysis, BULLSEYE effectively addresses the limitations of traditional fuzzing methods, particularly in the context of closed-source Linux-based firmware. The results demonstrate that BULLSEYE not only reproduces vulnerabilities more consistently than existing baselines but also significantly reduces the Time-to-Exposure, achieving improvements of up to 72.5 times over competitors.
BULLSEYE achieves a staggering 9.5x to 72.5x reduction in Time-to-Exposure for firmware vulnerabilities, setting a new benchmark in directed fuzzing.
The widespread adoption of Internet of Things (IoT) devices has expanded the digital attack surface, making firmware analysis critical for modern software security. A key security concern stems from the frequent reuse of third-party software components, a practice that often introduces known vulnerabilities into firmware images. Whether a given image actually exposes such a flaw is an open question, and public proof-of concept exploits make answering it urgent. Directed Greybox Fuzzing (DGF), a technique that enables targeted exploration of specific binary locations, offers a promising solution for detecting such vulnerabilities. However, DGF has reached firmware only at function granularity, too coarse to aim at the vulnerable block itself. This article presents BULLSEYE, the first DGF framework to schedule closed-source Linux-based firmware fuzzing by basic-block-level distance to user-specified targets. Our methodology combines static and dynamic analysis to enable DGF in the constrained firmware domain, focusing on vulnerabilities in reused third-party components. We introduce novel DGF heuristics that address limitations of traditional approaches. We compare BULLSEYE against four greybox-fuzzing baselines sharing its execution back-end, including reimplementations of AFLGO and WINDRANGER, and against GREENHOUSE, a state-of-the-art firmware re-hosting framework. On 40 vulnerability sites across 32 firmware images, BULLSEYE reproduces every target within budget, against 35 for the strongest of the four baselines, and reduces Time-to-Exposure by a geometric mean of 9.5x to 72.5x over them; against GREENHOUSE, on the 18 targets its pipeline supports, BULLSEYE is faster by a geometric mean of 9.8x.
