Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Multi-target Coverage-based Greybox Fuzzing

Masami Ichikawa

Abstract

In recent years, fuzzing has been widely applied not only to application software but also to system software, including the Linux kernel and firmware, and has become a powerful technique for vulnerability discovery. Among these approaches, Coverage-based grey-box fuzzing, which utilizes runtime code coverage information, has become the dominant methodology. Conventional fuzzing techniques primarily target a single software component and have paid little attention to cooperative execution with other software. However, modern system software architectures commonly consist of firmware and an operating system that operate cooperatively through well-defined interfaces, such as OpenSBI in the RISC-V architecture and OP-TEE in the ARM architecture. In this study, we investigate fuzzing techniques for architectures in which an operating system and firmware operate cooperatively. In particular, we propose a fuzzing method that enables deeper exploration of the system by leveraging the code coverage of each cooperating software component as feedback, compared to conventional Single-target fuzzing. To observe the execution of the operating system and firmware in a unified manner, our method adopts QEMU as a virtualization environment and executes fuzzing by booting the system within a virtual machine. This enables the measurement of code coverage across software boundaries. Furthermore, we implemented the proposed method as a Multi-target Coverage-based Greybox Fuzzer called MTCFuzz and evaluated its effectiveness.

Multi-target Coverage-based Greybox Fuzzing

Abstract

In recent years, fuzzing has been widely applied not only to application software but also to system software, including the Linux kernel and firmware, and has become a powerful technique for vulnerability discovery. Among these approaches, Coverage-based grey-box fuzzing, which utilizes runtime code coverage information, has become the dominant methodology. Conventional fuzzing techniques primarily target a single software component and have paid little attention to cooperative execution with other software. However, modern system software architectures commonly consist of firmware and an operating system that operate cooperatively through well-defined interfaces, such as OpenSBI in the RISC-V architecture and OP-TEE in the ARM architecture. In this study, we investigate fuzzing techniques for architectures in which an operating system and firmware operate cooperatively. In particular, we propose a fuzzing method that enables deeper exploration of the system by leveraging the code coverage of each cooperating software component as feedback, compared to conventional Single-target fuzzing. To observe the execution of the operating system and firmware in a unified manner, our method adopts QEMU as a virtualization environment and executes fuzzing by booting the system within a virtual machine. This enables the measurement of code coverage across software boundaries. Furthermore, we implemented the proposed method as a Multi-target Coverage-based Greybox Fuzzer called MTCFuzz and evaluated its effectiveness.

Paper Structure

This paper contains 43 sections, 3 equations, 17 figures, 14 tables, 5 algorithms.

Table of Contents

  1. Introduction
  2. Background and Motivation
  3. Objectives and Contributions
  4. Organization of This Thesis
  5. Fuzzing
  6. Fuzzing Techniques
  7. Greybox Fuzzing
  8. Code Coverage Measurement Techniques
  9. The code coverage measurement in the AFL
  10. The code coverage measurement in the Linux kernel
  11. Background and Limitations of Coverage-Guided Fuzzing
  12. Proposed Approach
  13. Multi-target Coverage-based Greybox Fuzzing Method
  14. Design of MTCFuzz
  15. Implementation of MTCFuzz
  16. ...and 28 more sections

Figures (17)

  • Figure 1: Memory layout on RISC-V, where the User application, Linux kernel, and OpenSBI operate in isolated address ranges while interacting through a shared memory region.
  • Figure 2: TrustZone architecture for Cortex-A, illustrating the separation between the Normal World and the Secure World.
  • Figure 3: Example of basic blocks as displayed by Ghidra. A basic block consists of a sequence of instructions ending at a branch instruction, and control flow diverges to different successor blocks according to the branch.
  • Figure 4: Example of basic block transitions in AFL. Transitions from $BB_i$ to $BB_j$ and from $BB_j$ to $BB_i$ are distinguished.
  • Figure 5: Execution flow across software boundaries, where execution propagates from applications to the OS and firmware.
  • ...and 12 more figures