一句话：提出 EQUAFL，通过增强用户态模拟自动构建执行环境，使 IoT 应用可完全在用户态下高效灰盒模糊测试。
灰盒模糊测试难以直接用于 Linux IoT 设备应用，因其执行高度依赖特定系统环境与硬件。现有工作用全系统模拟保证兼容性，但开销远高于用户态模拟；Firm-AFL 等虽有混合尝试，仍无法让应用完全运行于用户态模拟。作者提出 EQUAFL：先在系统级模拟下运行应用，观察其在用户态模拟中可能卡住或崩溃的关键点，据此迁移所需运行环境；再用增强的用户态模拟重放网络与资源管理相关的系统调用。在 70 个 IoT 设备的网络应用上评估，其 fuzzing 效率平均比全系统模拟的 AFL-QEMU 快 26 倍、比 Firm-AFL 快 14 倍，并发现 10 个漏洞（含 6 个 CVE）。
Greybox fuzzing has become one of the most effective vulnerability discovery techniques. However, greybox fuzzing techniques cannot be directly applied to applications in IoT devices. The main reason is that executing these applications highly relies on specific system environments and hardware. To execute the applications in Linux-based IoT devices, most existing fuzzing techniques use full-system emulation for the purpose of maximizing compatibility. However, compared with user-mode emulation, full-system emulation suffersfrom great overhead. Therefore, some previous works, such as Firm-AFL, propose to combine full-system emulation and user-mode emulation to speed up the fuzzing process. Despite the attempts of trying to shift the application towards user-mode emulation, no existing technique supports to execute these applications fully in the user-mode emulation. To address this issue, we propose EQUAFL, which can automatically set up the execution environment to execute embedded applications under user-mode emulation. EQUAFL first executes the application under full-system emulation and observe for the key points where the program may get stuck or even crash during user-mode emulation. With the observed information, EQUAFL can migrate the needed environment for user-mode emulation. Then, EQUAFL uses an enhanced user-mode emulation to replay system calls of network, and resource management behaviors to fulfill the needs of the embedded application during its execution. We evaluate EQUAFL on 70 network applications from different series of IoT devices. The result shows EQUAFL outperforms the state-of-the-arts in fuzzing efficiency (on average, 26 times faster than AFL-QEMU with full-system emulation, 14 times than Firm-AFL). We have also discovered ten vulnerabilities including six CVEs from the tested firmware images.
DOI 原文 ·
@inproceedings{paperbot7423,
title = {Efficient greybox fuzzing of applications in Linux-based IoT devices via enhanced user-mode emulation},
author = {Yaowen Zheng and Yuekang Li and Cen Zhang and Hongsong Zhu and Yang Liu and Limin Sun},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534414}
}