SnapFuzz: high-throughput fuzzing of network applications

Abstract

In recent years, fuzz testing has benefited from increased computational power and important algorithmic advances, leading to systems that have discovered many critical bugs and vulnerabilities in production software. Despite these successes, not all applications can be fuzzed efficiently. In particular, stateful applications such as network protocol implementations are constrained by a low fuzzing throughput and the need to develop complex fuzzing harnesses that involve custom time delays and clean-up scripts.In this paper, we present SnapFuzz, a novel fuzzing framework for network applications. SnapFuzz offers a robust architecture that transforms slow asynchronous network communication into fast synchronous communication, snapshots the target at the latest point at which it is safe to do so, speeds up file operations by redirecting them to a custom in-memory filesystem, and removes the need for many fragile modifications, such as configuring time delays or writing clean-up scripts.Using SnapFuzz, we fuzzed five popular networking applications: LightFTP, TinyDTLS, Dnsmasq, LIVE555 and Dcmqrscp. We report impressive performance speedups of 62.8 x, 41.2 x, 30.6 x, 24.6 x, and 8.4 x, respectively, with significantly simpler fuzzing harnesses in all cases. Due to its advantages, SnapFuzz has also found 12 extra crashes compared to AFLNet in these applications. CCS CONCEPTS• Software and its engineering → Software testing and debugging; • Security and privacy → Systems security.

ResolFuzz: Differential Fuzzing of DNS Resolvers

“…Automatic testing of network services has been subject to several other related works [2,8,11,14,16,17,19,20,27,29,32,34]. However, we are the first to create an advanced fuzzer for DNS resolvers.…”

“…Fuzzing uses a forkserver, which allows for fast restarts and parallelization. SnapFuzz [2] is an iteration of AFLnet with increased performance, achieved with new binary rewriting. The rewriting replaces file system accesses with a custom in-memory implementation, replaces the TCP and UDP socket calls with UNIX domain sockets, and optimizes the forkserver.…”

StateAFL: Greybox fuzzing for stateful network servers

“…For OpenSSH, the lower throughput was caused by an additional delay between request messages, which was configured to make the analysis of in-memory states more deterministic. A potential extennsion to avoid the need for such delays, and in general for improving the fuzzing throughput, is represented by ongoing research on snapshot-based fuzzing, which saves and restores the state of the entire server process at selected times (Li et al 2022;Andronidis and Cadar 2022). Please note that snapshot-based fuzzing is complementary area of research to STATEAFL, which infers states from a fine-grained analysis of process memory, and would guide the snapshot-based process by identifying unique application-level states.…”

VConMC: Enabling Consistency Verification for Distributed Systems Using Implementation-Level Model Checkers and Consistency Oracles

“…However, previous works have not studied how to detect violations of consistency models well when they actually occur. One line of previous works either leverages random testing approaches like fuzzing methods [8][9][10][11][12][13]. However, fuzzing cannot systematically explore the state space of SUTs; therefore, it may miss some bugs.…”