Cohort: Multiple Coverage Guided Greybox Fuzzing

Abstract

Greybox fuzzing is a widely used technique for automatically discovering vulnerabilities in programs. Existing greybox fuzzing approaches primarily rely on runtime coverage feedback to guide testing, continuously exploring program paths to uncover defects. However, using a single coverage metric sometimes fails to effectively guide testing toward deeper program execution. Moreover, fine-grained coverage metrics can lead to excessive seed corpus expansion, reducing efficiency. To address these limitations, we propose Cohort, a novel greybox fuzzing technique that combines multiple coverage metrics and selectively applies them to high-priority regions with unsolved constraints. During runtime, Cohort maintains a precise list of basic blocks associated with unsolved constraints, and concentrates various coverage feedback mechanisms on these blocks, since solving their constraints is crucial for deeper exploration. To sustain efficiency, Cohort continuously prunes seed corpus by retaining only those seeds that contribute useful coverage information. In addition, Cohort dynamically recompiles the target program to remove redundant instrumentation and identifies critical byte regions in inputs, thereby improving performance while maintaining low overhead. Experimental results show that Cohort outperforms state-of-the-art fuzzers, achieving an average of 24.6% higher edge coverage and 30.6% higher vulnerability detection rate. Furthermore, Cohort discovered 8 previously unknown vulnerabilities, with 8 CVEs assigned.