FCFuzz: Format Constrained Fuzzing for Network Protocol Implementations
摘要
Grey-box fuzzing has been shown to be effective in addressing vulnerability detection issues in network protocol implementations. However, mutation methods that do not impose format constraints frequently corrupt the message format, leading to test cases that are rejected by protocol implementations. In this paper, we propose FCFuzz, a format-constrained fuzzing method that incorporates format constraints into mutating test cases, resulting in more efficient message sequences with a greater likelihood of passing the format parsing phase of the protocol implementation. We designed the message format tree to represent format knowledge for applying format constraints to mutations. Based on the message format tree, we design an energy allocation method with important node priority and a flexible message-level mutation to obtain more interesting test cases. To verify the validity of FCFuzz, it is evaluated on four typical protocol implementations. It is shown that format-constrained mutations can produce higher-quality protocol messages, making it more likely that messages will pass the implementation parsing phase and explore the implementation internals more fully. Compared to the baseline tool SGFuzz, FCFuzz has a better chance to pass the parse phase, and performed 25.93% fewer executions in the same amount of time, but triggered up to 158.94% more state transitions and achieved 1.70% more branch coverage.