Fuzzing BusyBox: Leveraging LLM and Crash Reuse for Embedded Bug Unearthing

• DOI: 10.48550/arxiv.2403.03897
• Publication Date: 2024-03-06
• Authors: Asmita Asmita; Yaroslav Oliinyk; Michael L. Scott; Ryan Tsang; Chongzhou Fang; Houman Homayoun
• Keywords: Fuzz testing

BusyBox, an open-source software bundling over 300 essential Linux commands into a single executable, is ubiquitous in Linux-based embedded devices. Vulnerabilities BusyBox can have far-reaching consequences, affecting wide array of This research, driven by the extensive use delved its analysis. The study revealed prevalence older versions real-world products, prompting us to conduct fuzz testing on BusyBox. Fuzzing, pivotal method, aims induce crashes that are subsequently scrutinized uncover vulnerabilities. Within this study, we introduce two techniques fortify testing. first technique enhances fuzzing leveraging Large Language Models (LLM) generate target-specific initial seeds. Our showed substantial increase when using LLM-generated seeds, highlighting potential LLM efficiently tackle typically labor-intensive task generating second involves repurposing previously acquired crash data from similar fuzzed targets before initiating new target. approach streamlines time-consuming process providing directly target commencing fuzzing. We successfully identified latest without conducting traditional fuzzing, emphasizing effectiveness and reuse enhancing improving vulnerability detection systems. Additionally, manual triaging was performed identify nature