Developers utilize third-party libraries to improve productivity, which also introduces potential security risks. Existing approaches generate tests for public functions to trigger library vulnerabilities from client programs, yet they depend on proof-of-concepts (PoCs), which are often unavailable. In this paper, we propose a new approach, LiveFuzz, based on directed greybox fuzzing (DGF) to detect the exploitability of library vulnerabilities from client programs without PoCs. LiveFuzz exploits a target tuple to extend existing DGF techniques to cross-program scenarios. Based on the target tuple, LiveFuzz introduces a novel Abstract Path Mapping mechanism to project execution paths, mitigating the preference for shorter paths. LiveFuzz also proposes a risk-based adaptive mutation to mitigate excessive mutation. To evaluate LiveFuzz, we construct a new dataset including 61 cases of library vulnerabilities exploited from client programs. Results show that LiveFuzz increases the number of target-reachable paths compared with all baselines and improves the average speed of vulnerability exposure. Three vulnerabilities are triggered exclusively by LiveFuzz.

翻译：开发者在使用第三方库以提高生产效率的同时，也引入了潜在的安全风险。现有方法通过生成针对公共函数的测试用例来从客户端程序触发库漏洞，但这些方法依赖于通常不可用的概念验证（PoC）程序。本文提出一种基于定向灰盒模糊测试（DGF）的新方法LiveFuzz，无需PoC即可从客户端程序检测库漏洞的可利用性。LiveFuzz利用目标元组将现有DGF技术扩展至跨程序场景。基于该目标元组，LiveFuzz引入新颖的抽象路径映射机制来投影执行路径，从而缓解对较短路径的偏好。同时，LiveFuzz提出基于风险的自适应变异策略以抑制过度变异行为。为评估LiveFuzz，我们构建了包含61例从客户端程序利用的库漏洞的新数据集。结果表明，与所有基线方法相比，LiveFuzz增加了可达目标路径的数量，并将漏洞暴露的平均速度提升了。其中三个漏洞仅由LiveFuzz触发。