Multi-target Coverage-based Greybox Fuzzing

TL;DR

This paper introduces MTCFuzz, a novel greybox fuzzing approach that explores multiple cooperating system components like firmware and OS simultaneously, enhancing vulnerability detection in complex system architectures.

Contribution

It proposes a multi-target coverage-based fuzzing method that leverages code coverage from multiple components, implemented in a virtualized environment for unified execution.

Findings

Improved code coverage across system components.

Enhanced vulnerability discovery in firmware and OS.

Effective fuzzing in RISC-V and ARM architectures.

Abstract

In recent years, fuzzing has been widely applied not only to application software but also to system software, including the Linux kernel and firmware, and has become a powerful technique for vulnerability discovery. Among these approaches, Coverage-based grey-box fuzzing, which utilizes runtime code coverage information, has become the dominant methodology. Conventional fuzzing techniques primarily target a single software component and have paid little attention to cooperative execution with other software. However, modern system software architectures commonly consist of firmware and an operating system that operate cooperatively through well-defined interfaces, such as OpenSBI in the RISC-V architecture and OP-TEE in the ARM architecture. In this study, we investigate fuzzing techniques for architectures in which an operating system and firmware operate cooperatively. In particular, we propose a fuzzing method that enables deeper exploration of the system by leveraging the code coverage of each cooperating software component as feedback, compared to conventional Single-target fuzzing. To observe the execution of the operating system and firmware in a unified manner, our method adopts QEMU as a virtualization environment and executes fuzzing by booting the system within a virtual machine. This enables the measurement of code coverage across software boundaries. Furthermore, we implemented the proposed method as a Multi-target Coverage-based Greybox Fuzzer called MTCFuzz and evaluated its effectiveness.