一句话：提出 DDSFuzz，通过生成 DDS 动态网络配置输入并结合差分模糊测试，有效检测 DDS 程序缺陷。
Data Distribution Service（DDS）是信息物理系统中广泛使用的分布式网络协议，其正式设计规范提供了灵活的 QoS 与安全配置。然而 DDS 程序既存在违反设计规范的语义缺陷，也存在传统软件缺陷。已有网络协议模糊器主要面向客户端-服务器模型，通过变异输入数据包进行测试，未考虑 DDS 特有输入空间（如动态网络拓扑构建、QoS 与 DDS 安全配置）以及 DDS 特有语义缺陷（如错误的拓扑构建）的影响，因此不适用于 DDS 程序。本文提出 DDSFuzz：它将 DDS 动态网络配置输入生成器与定制化的先进数据包变异器集成，生成时考虑 DDS 特有输入空间、DDS 拓扑以及参数配置与依赖关系，从而能够测试仅在特定 DDS 网络配置下可执行的代码；同时基于 DDS 专属 API 与监听器构建差分模糊测试缺陷检测器，以发现 DDS 特有语义缺陷。作者在 Fast DDS、Cyclone DDS 和 OpenDDS 三个主流 DDS 程序上评估，共发现 20 个缺陷，其中 7 个被分配 CVE，且代码覆盖率平均为现有模糊器的 6.44 倍。
Data Distribution Service (DDS) is a distributed network protocol widely used in cyber-physical systems. DDS provides flexible configurations defined in the formal design specification for safety and security. However, DDS programs suffer from both semantic bugs violating design specifications and traditional software bugs. To discover bugs, network protocol fuzzers have focused on testing client-server models by mutating input packets. However, they are unsuitable for fuzzing DDS programs due to a lack of consideration of the DDS-specific features, such as the DDS-specific input spaces (e.g., dynamic network topology formation and QoS and DDS security configurations) and impacts of DDS-specific semantic bugs (e.g., incorrect topology construction).In this paper, we propose DDSFuzz, a fuzzing framework effective for DDS programs by leveraging the DDS-specific features. Specifically, we develop a DDS dynamic network configuration input generator integrated with a customized state-of-the-art packet input mutator. This configuration input generator produces inputs while considering DDS-specific input spaces, DDS topologies, and parameter configurations and dependencies. This scheme enables DDSFuzz to test code that can be executable in certain DDS network configurations. Furthermore, our differential-fuzzing-based bug detector uncovers DDS-specific semantic bugs, built upon DDSspecific APIs and listeners. We evaluate DDSFuzz with three major DDS programs: Fast DDS, Cyclone DDS, and OpenDDS. As a result, DDSFuzz found 20 bugs, and seven CVEs have been assigned. Furthermore, DDSFuzz shows an average of 6.44 times higher code coverage than that of existing fuzzers showing the effectiveness of DDS bug detection.CCS Concepts• Software and its engineering → Software testing and debugging; • Computer systems organization → Robotics; • Security and privacy → Mobile and wireless security.
@inproceedings{RyuKLKBRK24,
title = {Differential Fuzzing for Data Distribution Service Programs with Dynamic Configuration},
author = {Dohyun Ryu and Giyeol Kim and Daeun Lee and Seongjin Kim and Seungjin Bae and Junghwan Rhee and Taegyu Kim},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695073}
}