一句话：提出双向模糊测试框架 DualFuzz，同时测试 Wi-Fi NIC 收发过程以发现漏洞。
Wi-Fi 网络接口卡（NIC）的安全性至关重要，而现有 Wi-Fi 模糊测试器通常分别测试发送与接收，忽略二者交互，导致效率低下。本文提出 DualFuzz，一个双向模糊测试框架，同时测试 Wi-Fi NIC 的发送和接收过程。它自动识别 NIC 内交互行为并构建 Transmission-Reception Model（TRModel），刻画影响交互的 Wi-Fi 帧；据此采用延迟引导的模糊测试协调探索收发交互逻辑，并用 liveness 与 equivalence 检测器实时监控异常状态、发现漏洞。作者在 8 款 Intel、Realtek 等厂商的 Wi-Fi NIC 上评估，相比 OwFuzz、wpaspy 和 Greyhound 分别多检测出 75%、163% 和 250% 的漏洞，共发现 21 个未知漏洞，其中 7 个获 CVE。
Wi-Fi Network Interface Cards (NICs) are vital for enabling wireless connectivity across a wide range of devices. Ensuring their security is critical, as vulnerabilities can expose entire networks to threats. Fuzzing is a promising technique for detecting such flaws. However, existing Wi-Fi fuzzers typically test transmission and reception separately, overlooking their interactions and resulting in inefficient testing.In this work, we present DualFuzz, a dual-directional fuzzing framework designed to simultaneously test both transmission and reception processes in Wi-Fi NICs. First, DualFuzz automatically identifies interaction behaviors within Wi-Fi NICs and constructs a Transmission-Reception Model (TRModel) to characterize Wi-Fi frames that influence these interactions. Leveraging this model, DualFuzz utilizes latency guided fuzzing to efficiently coordinate exploring transmission and reception interaction logics. Finally, we propose liveness and equivalence detectors that enable real-time monitoring to identify abnormal states and uncover potential vulnerabilities in Wi-Fi NICs. We implemented and evaluated DualFuzz on eight widely used Wi-Fi NICs, incorporating chipsets from various manufacturers (e.g., Intel and Realtek). Compared to state-of-the-art Wi-Fi fuzzers like OwFuzz, wpaspy, and Greyhound, DualFuzz detects 75%, 163%, and 250% more vulnerabilities, respectively. In total, it uncovered 21 previously unknown vulnerabilities, 7 of which have been assigned CVEs.
DOI 原文 ·
@inproceedings{paperbot9378,
title = {DualFuzz: Detecting Vulnerability in Wi-Fi NICs through Dual-Directional Fuzzing},
author = {Yuanliang Chen and Fuchen Ma and Yanyang Zhao and Yuanyi Li and Yu Jiang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00069}
}