一句话：首次系统刻画嵌入式网络栈漏洞，并提出基于协议状态种子与数据包字段系统修改的测试框架。
嵌入式网络栈（ENS）使低资源设备能够联网，其缺陷常是可远程触发、影响物理世界的高危漏洞；此前缺乏对 ENS 缺陷特性的系统刻画，实践主要依赖昂贵且不稳定的 fuzzing。本文首次系统刻画 ENS 安全漏洞：分析 6 个开源 ENS 的 61 个漏洞，发现多数位于传输层与网络层、需协议进入不同状态、且仅需对单个数据包做 1–2 处修改即可触发。据此提出系统化测试框架，聚焦传输/网络层，使用覆盖协议状态的种子并系统修改数据包字段。在 4 个 ENS 上复现了已报告 14 个 IP/TCP/UDP 漏洞中的 12 个，并在覆盖全部协议状态、每包至多 3 处修改的有界测试中发现 7 个新缺陷（6 个获 CVE），其中 3 个 ENS 的缺陷先前 fuzzing 未能发现。结果表明应先行系统化测试，再考虑 fuzzing。
Embedded Network Stacks (ENS) enable low-resource devices to communicate with the outside world, facilitating the development of Internet of Things and Cyber-Physical Systems. Some defects in ENS are thus high-severity cybersecurity vulnerabilities: they are remotely triggerable and can impact the physical world. While prior research has shed light on the characteristics of defects in many classes of software systems, no study has described the properties of ENS defects nor identified a systematic technique to expose them. The most common automated approach to detecting ENS defects is feedback-driven randomized dynamic analysis (“fuzzing”), a costly and unpredictable technique. This paper provides the first systematic characterization of cybersecurity vulnerabilities in ENS. We analyzed 61 vulnerabilities across 6 open-source ENS. Most of these ENS defects are concentrated in the transport and network layers of the network stack, require reaching different states in the network protocol, and can be triggered by only 1–2 modifications to a single packet. We therefore propose a novel systematic testing framework that focuses on the transport and network layers, uses seeds that cover a network protocol's states, and systematically modifies packet fields. We evaluate this framework on 4 ENS and replicated 12 of the 14 reported IP/TCP/UDP vulnerabilities. On recent versions of these ENSs, it discovered 7 novel defects (6 assigned CVES) during a bounded systematic test that covered all protocol states and made up to 3 modifications per packet. We found defects in 3 of the 4 ENS we tested that had not been found by prior fuzzing research. Our results suggest that fuzzing should be deferred until after systematic testing is employed.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{AmusuoMXMD23,
title = {Systematically Detecting Packet Validation Vulnerabilities in Embedded Network Stacks},
author = {Paschal C. Amusuo and Ricardo Andrés Calvo Méndez and Zhongwei Xu and Aravind Machiry and James C. Davis},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00095}
}