NSFuzz: Towards Efficient and State-Aware Network Service Fuzzing

Abstract

As an essential component responsible for communication, network services are security-critical, and it is vital to find vulnerabilities in them. Fuzzing is currently one of the most popular software vulnerability discovery techniques, widely adopted due to its high efficiency and low false positives. However, existing coverage-guided fuzzers mainly aim at stateless local applications, leaving stateful network services underexplored. Recently, some fuzzers targeting network services have been proposed but have certain limitations, e.g., insufficient or inaccurate state representation and low testing efficiency. In this paper, we propose a new fuzzing solution NSFuzz for stateful network services. Specifically, we studied typical implementations of network service programs and figured out how they represent states and interact with clients. Accordingly we propose (1) a program variable-based state representation scheme and (2) an efficient interaction synchronization mechanism to improve fuzzing efficiency. We have implemented a prototype of NSFuzz, which uses static analysis and annotation APIs to identify synchronization points and state variables within the services, then achieves fast I/O synchronization and accurate service state tracing to carry out efficient state-aware fuzzing via lightweight compile-time instrumentation. The evaluation results show that compared with other network service fuzzers, including AFL net and S tate AFL, our solution NSFuzz could infer a more accurate state model during fuzzing and improve the fuzzing throughput by up to 200x. Besides, NSFuzz could improve the code coverage by up to 25% and trigger more crashes in less time. Furthermore, we performed a fuzzing campaign to find new bugs in the latest version of the target services, and 8 zero-day vulnerabilities have been found by NSFuzz.