Abstract

The widespread adoption of Internet of Things (IoT) devices has expanded the digital attack surface, Firmware Fuzzing making firmware analysis critical for modern software security. A key security concern stems Embedded Linux Security from the frequent reuse of third-party software components, a practice that often introduces known Directed Fuzzing vulnerabilities into firmware images. Whether a given image actually exposes such a flaw is an open Software Security question, and public proof-of concept exploits make answering it urgent. Vulnerability Detection Directed Greybox Fuzzing (DGF), a technique that enables targeted exploration of specific binary locations, offers a promising solution for detecting such vulnerabilities. However, DGF has reached firmware only at function granularity, too coarse to aim at the vulnerable block itself. This article presents BULLSEYE, the first DGF framework to schedule closed-source Linuxbased firmware fuzzing by basic-block-level distance to user-specified targets. Our methodology combines static and dynamic analysis to enable DGF in the constrained firmware domain, focusing on vulnerabilities in reused third-party components. We introduce novel DGF heuristics that address limitations of traditional approaches. We compare BULLSEYE against four greybox-fuzzing baselines sharing its execution back-end, including reimplementations of AFLGO and WINDRANGER, and against GREENHOUSE, a state-of-the-art firmware re-hosting framework. On 40 vulnerability sites across 32 firmware images, BULLSEYE reproduces every target within budget, against 35 for the strongest of the four baselines, and reduces Time-to-Exposure by a geometric mean of 9 _._ 5 to 72 _._ 5 over them; against GREENHOUSE, on the 18 targets its pipeline supports, BULLSEYE is faster by a geometric mean of 9 _._ 8.