一句话：提出 ROS 系统模糊测试器 R2D2，利用回调追踪与运行时状态引导提升覆盖率并发现漏洞。
针对现有 ROS 测试方法难以捕获复杂、有状态行为而导致模糊测试效果受限的问题，本文提出 R2D2，一种以 ROS 运行时状态为引导的系统模糊测试器。R2D2 采用系统化插桩策略，捕获系统运行时行为并实时刻画当前系统状态，从而更深入地理解系统行为，并更有效地探索 ROS 庞大的状态空间。作者在四个知名 ROS 应用上评估 R2D2，结果显示其代码覆盖率相较先进 ROS 模糊测试器 Ros2Fuzz 和 RoboFuzz 分别提升 3.91 倍和 2.56 倍，并发现 39 个此前未知的漏洞，其中 6 个已在 ROS 运行时和应用中修复。R2D2 的平均执行开销和内存开销分别为 10.4% 和 1.0%。
The Robot Operating System 2 (ROS) is the de-facto standard for robotic software development, with a wide application in diverse safety-critical domains. There are many efforts in testing that seek to deliver a more secure ROS codebase. However, existing testing methods are often inadequate to capture the complex and stateful behaviors inherent to ROS deployments, resulting in limited test- ing effectiveness. In this paper, we propose R2D2, a ROS system fuzzer that leverages ROS’s runtime states as guidance to increase fuzzing effectiveness and efficiency. Unlike traditional fuzzers, R2D2 employs a systematic instrumentation strategy that captures the system’s runtime behaviors and profiles the current system state in real-time. This approach provides a more in-depth understanding of system behaviors, thereby facilitating a more insightful explo- ration of ROS’s extensive state space. For evaluation, we applied it to four well-known ROS applications. Our evaluation shows that R2D2 achieves an improvement of 3.91× and 2.56× in code coverage compared to state-of-the-art ROS fuzzers, including Ros2Fuzz and RoboFuzz, while also uncovering 39 previously unknown vulnera- bilities, with 6 fixed in both ROS runtime and ROS applications. For its runtime overhead, R2D2 maintains an average execution and memory usage overhead with 10.4% and 1.0% in respect, making R2D2 effective in ROS testing.
@inproceedings{paperbot8510,
title = {Enhancing ROS System Fuzzing through Callback Tracing},
author = {Yuheng Shen and Jianzhong Liu and Yiru Xu and Hao Sun and Mingzhe Wang and Nan Guan and Heyuan Shi and Yu Jiang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652111}
}