SnapFuzz: An Efficient Fuzzing Framework for Network Applications

TL;DR

SnapFuzz is a new fuzzing framework that significantly improves the efficiency of testing network applications by transforming asynchronous communication into synchronous, snapshotting states, and optimizing file operations, leading to faster testing and more bug discoveries.

Contribution

Introduces SnapFuzz, a novel framework that enhances fuzzing efficiency for network applications through architecture innovations and performance optimizations.

Findings

Achieved up to 62.8x speedup in fuzzing throughput.

Discovered 12 additional crashes compared to AFLNet.

Simplified fuzzing harness development for network applications.

Abstract

In recent years, fuzz testing has benefited from increased computational power and important algorithmic advances, leading to systems that have discovered many critical bugs and vulnerabilities in production software. Despite these successes, not all applications can be fuzzed efficiently. In particular, stateful applications such as network protocol implementations are constrained by their low fuzzing throughput and the need to develop fuzzing harnesses that reset their state and isolate their side effects. In this paper, we present SnapFuzz, a novel fuzzing framework for network applications. SnapFuzz offers a robust architecture that transforms slow asynchronous network communication into fast synchronous communication, snapshots the target at the latest point at which it is safe to do so, speeds up all file operations by redirecting them to a custom in-memory filesystem, and removes the need for many fragile modifications, such as configuring time delays or writing clean-up scripts, together with several other improvements. Using SnapFuzz, we fuzzed five popular networking applications: LightFTP, TinyDTLS, Dnsmasq, LIVE555 and Dcmqrscp. We report impressive performance speedups of 62.8x, 41.2x, 30.6x, 24.6x, and 8.4x, respectively, with significantly simpler fuzzing harnesses in all cases. Through its performance advantage, SnapFuzz has also found 12 extra crashes compared to AFLNet in these applications.