{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T10:30:32Z","timestamp":1790937032171,"version":"4.1.0"},"publisher-location":"New York, NY, USA","reference-count":54,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T00:00:00Z","timestamp":1726012800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,9,11]]},"DOI":"10.1145\/3650212.3680316","type":"proceedings-article","created":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T11:44:25Z","timestamp":1726055065000},"page":"730-742","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":3,"title":["Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-4779-9891","authenticated-orcid":false,"given":"Haolai","family":"Wei","sequence":"first","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China \/ University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4994-6046","authenticated-orcid":false,"given":"Liwei","family":"Chen","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China \/ University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9751-8268","authenticated-orcid":false,"given":"Zhijie","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China \/ University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-7152-9210","authenticated-orcid":false,"given":"Gang","family":"Shi","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China \/ University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-9868-5353","authenticated-orcid":false,"given":"Dan","family":"Meng","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering at Chinese Academy of Sciences, Beijing, China \/ University of Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,9,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2018. CVE-2018-7875 CVE-2018-8964 CVE-2018-7871 Patch. https:\/\/github.com\/libming\/libming\/commit\/3a000c7b6fe978dd9925266bb6847709e06dbaa3"},{"key":"e_1_3_2_1_2_1","unstructured":"2018. CVE-2018-9009 Patch. https:\/\/github.com\/libming\/libming\/commit\/1d698a4b1f03d6136bbf2b0171b86985be553454"},{"key":"e_1_3_2_1_3_1","unstructured":"2018. CVE-2018-9132 Patch. https:\/\/github.com\/hlef\/libming\/commit\/d13db01ea1c416f51043bef7496cfb25c2dde29a"},{"key":"e_1_3_2_1_4_1","unstructured":"2019. ASAN public interface. https:\/\/github.com\/google\/sanitizers\/wiki\/AddressSanitizer"},{"key":"e_1_3_2_1_5_1","unstructured":"2019. CVE-2019-7663 Patch. https:\/\/gitlab.com\/libtiff\/libtiff\/-\/commit\/802d3cbf3043be5dce5317e140ccb1c17a6a2d39"},{"key":"e_1_3_2_1_6_1","unstructured":"2020. CVE-2020-19143 Patch. https:\/\/gitlab.com\/libtiff\/libtiff\/-\/commit\/84b8b9a3e7c5eca4bb7fea85bbd67d67507946e7"},{"key":"e_1_3_2_1_7_1","unstructured":"2020. CVE-2020-27828 Patch. https:\/\/github.com\/jasper-software\/jasper\/pull\/253\/commits\/4cd52b5daac62b00a0a328451544807ddecf775f"},{"key":"e_1_3_2_1_8_1","unstructured":"2021. CVE-2021-3246 Patch. https:\/\/github.com\/libsndfile\/libsndfile\/pull\/713\/commits\/243b518137d9a921a4c8630accdde2b6b64975b2"},{"key":"e_1_3_2_1_9_1","unstructured":"2022. CVE-2022-3598 Patch. https:\/\/gitlab.com\/libtiff\/libtiff\/-\/commit\/cfbb883bf6ea7bedcb04177cc4e52d304522fdff"},{"key":"e_1_3_2_1_10_1","unstructured":"2022. CVE-2022-45703 Patch. https:\/\/sourceware.org\/git\/gitweb.cgi?p=binutils-gdb.git;h=69bfd1759db41c8d369f9dcc98a135c5a5d97299"},{"key":"e_1_3_2_1_11_1","unstructured":"2023. CVE-2023-0799 Patch. https:\/\/gitlab.com\/libtiff\/libtiff\/-\/commit\/afaabc3e50d4e5d80a94143f7e3c997e7e410f68"},{"key":"e_1_3_2_1_12_1","unstructured":"2023. CVE-2023-1916 Patch. https:\/\/gitlab.com\/libtiff\/libtiff\/-\/merge_requests\/476"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","unstructured":"2024. Replication package. https:\/\/doi.org\/10.5281\/zenodo.12668172 10.5281\/zenodo.12668172","DOI":"10.5281\/zenodo.12668172"},{"key":"e_1_3_2_1_14_1","unstructured":"2024. Sleuth.. https:\/\/sites.google.com\/view\/sleuth-fuzzing-site"},{"key":"e_1_3_2_1_15_1","unstructured":"Lars Ole Andersen. 1994. Program analysis and specialization for the C programming language. https:\/\/citeseerx.ist.psu.edu\/document?repid=rep1&type=pdf&doi=b7efe971a34a0f2482e0b2520ffb31062dcdde62"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23371"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"e_1_3_2_1_18_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Blazytko Tim","year":"2020","unstructured":"Tim Blazytko, Moritz Schl\u00f6gel, Cornelius Aschermann, Ali Abbasi, Joel Frank, Simon W\u00f6rner, and Thorsten Holz. 2020. $AURORA$: Statistical crash analysis for automated root cause explanation. In 29th USENIX Security Symposium (USENIX Security 20). 235\u2013252. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/blazytko"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00104"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"e_1_3_2_1_22_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Chen Weiteng","year":"2020","unstructured":"Weiteng Chen, Xiaochen Zou, Guoren Li, and Zhiyun Qian. 2020. $KOOBE$: towards facilitating exploit generation of kernel $Out-Of-Bounds$ write vulnerabilities. In 29th USENIX Security Symposium (USENIX Security 20). 1093\u20131110. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/chen-weiteng"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510197"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2017.2785299"},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of Infiltrate, https:\/\/downloads.immunityinc.com\/infiltrate-archives\/Fundamentals_of_exploitation_revisited.pdf","author":"Dullien Thomas","year":"2011","unstructured":"Thomas Dullien and Halvar Flake. 2011. Exploitation and state machines. Proceedings of Infiltrate, https:\/\/downloads.immunityinc.com\/infiltrate-archives\/Fundamentals_of_exploitation_revisited.pdf"},{"key":"e_1_3_2_1_26_1","volume-title":"14th USENIX Workshop on Offensive Technologies (WOOT 20)","author":"Fioraldi Andrea","year":"2020","unstructured":"Andrea Fioraldi, Dominik Maier, Heiko Ei\u00df feldt, and Marc Heuse. 2020. $AFL++$: Combining incremental steps of fuzzing research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20). https:\/\/www.usenix.org\/conference\/woot20\/presentation\/fioraldi"},{"key":"e_1_3_2_1_27_1","volume-title":"29th USENIX security symposium (USENIX Security 20). 2577\u20132594. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/gan","author":"Gan Shuitao","unstructured":"Shuitao Gan, Chao Zhang, Peng Chen, Bodong Zhao, Xiaojun Qin, Dong Wu, and Zuoning Chen. 2020. $GREYONE$: Data flow sensitive fuzzing. In 29th USENIX security symposium (USENIX Security 20). 2577\u20132594. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/gan"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00040"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3182526"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","unstructured":"Adrian Herrera Mathias Payer and Antony L Hosking. 2022. DatAFLow: Toward a Data-Flow-Guided Fuzzer. ACM Transactions on Software Engineering and Methodology https:\/\/doi.org\/10.1145\/3587156 10.1145\/3587156","DOI":"10.1145\/3587156"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833751"},{"key":"e_1_3_2_1_32_1","volume-title":"2020 USENIX Annual Technical Conference (USENIX ATC 20)","author":"Jeon Yuseok","year":"2020","unstructured":"Yuseok Jeon, WookHyun Han, Nathan Burow, and Mathias Payer. 2020. $FuZZan$: Efficient sanitizer metadata design for fuzzing. In 2020 USENIX Annual Technical Conference (USENIX ATC 20). 249\u2013263. https:\/\/www.usenix.org\/conference\/atc20\/presentation\/jeon"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560575"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485364"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2004.1281665"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238176"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3051525"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833683"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.48"},{"key":"e_1_3_2_1_40_1","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"\u00d6sterlund Sebastian","year":"2020","unstructured":"Sebastian \u00d6sterlund, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2020. $ParmeSan$: Sanitizer-guided greybox fuzzing. In 29th USENIX Security Symposium (USENIX Security 20). 2289\u20132306. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/osterlund"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23404"},{"key":"e_1_3_2_1_42_1","unstructured":"Konstantin Serebryany Derek Bruening Alexander Potapenko and Dmitriy Vyukov. 2012. $AddressSanitizer$: A fast address sanity checker. In 2012 USENIX annual technical conference (USENIX ATC 12). 309\u2013318. https:\/\/www.usenix.org\/conference\/atc12\/technical-sessions\/presentation\/serebryany"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23368"},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892235"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.13"},{"key":"e_1_3_2_1_46_1","unstructured":"Julien Vanegue. 2013. The automated exploitation grand challenge. In H2HC Conference. https:\/\/openwall.info\/wiki\/_media\/people\/jvanegue\/files\/aegc_vanegue.pdf"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243847"},{"key":"e_1_3_2_1_48_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Yagemann Carter","year":"2021","unstructured":"Carter Yagemann, Matthew Pruett, Simon P Chung, Kennon Bittick, Brendan Saltaformaggio, and Wenke Lee. 2021. $ARCUS$: symbolic root cause analysis of exploits in production systems. In 30th USENIX Security Symposium (USENIX Security 21). 1989\u20132006. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/yagemann"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134085"},{"key":"e_1_3_2_1_50_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Yun Insu","year":"2018","unstructured":"Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. $QSYM$: A practical concolic execution engine tailored for hybrid fuzzing. In 27th USENIX Security Symposium (USENIX Security 18). 745\u2013761. https:\/\/www.usenix.org\/conference\/usenixsecurity18\/presentation\/yun"},{"key":"e_1_3_2_1_51_1","volume-title":"Afl-fuzz: Crash exploration mode. https:\/\/afl-1.readthedocs.io\/en\/latest\/fuzzing.html","author":"Zalewski Michal","year":"2018","unstructured":"Michal Zalewski. 2018. Afl-fuzz: Crash exploration mode. https:\/\/afl-1.readthedocs.io\/en\/latest\/fuzzing.html"},{"key":"e_1_3_2_1_52_1","volume-title":"american fuzzy lop (2.52 b). Retrieved April, 10","author":"Zalewski Michal","year":"2019","unstructured":"Michal Zalewski. 2019. american fuzzy lop (2.52 b). Retrieved April, 10 (2019), 2020. https:\/\/lcamtuf.coredump.cx\/afl\/"},{"key":"e_1_3_2_1_53_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zhang Yuchen","year":"2022","unstructured":"Yuchen Zhang, Chengbin Pang, Georgios Portokalidis, Nikos Triandopoulos, and Jun Xu. 2022. Debloating address sanitizer. In 31st USENIX Security Symposium (USENIX Security 22). 4345\u20134363. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zhang-yuchen"},{"key":"e_1_3_2_1_54_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Zou Xiaochen","year":"2022","unstructured":"Xiaochen Zou, Guoren Li, Weiteng Chen, Hang Zhang, and Zhiyun Qian. 2022. $SyzScope$: Revealing $High-Risk$ Security Impacts of $Fuzzer-Exposed$ Bugs in Linux kernel. In 31st USENIX Security Symposium (USENIX Security 22). 3201\u20133217. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/zou"}],"event":{"name":"ISSTA '24: 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis","location":"Vienna Austria","acronym":"ISSTA '24","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","AITO"]},"container-title":["Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3650212.3680316","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3650212.3680316","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:50:07Z","timestamp":1750287007000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3650212.3680316"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,11]]},"references-count":54,"alternative-id":["10.1145\/3650212.3680316","10.1145\/3650212"],"URL":"https:\/\/doi.org\/10.1145\/3650212.3680316","relation":{},"subject":[],"published":{"date-parts":[[2024,9,11]]},"assertion":[{"value":"2024-09-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}