NCFuzz: Configuration-Guided Network Service Fuzzing
TL;DR
This work tackles the problem of finding bugs under non-default configurations, termed ConfBug, by designing a new fuzzer called NCFuzz, which achieves higher coverage than baseline fuzzers and uses configuration knowledge and the relationships between configurations and network messages to guide the fuzzer toward new software states.
Abstract
Network services like FTP and DNS are critical components of modern reliable Internet infrastructure. Software fuzzing, especially network protocol fuzzing, is widely used to uncover flaws in these systems. However, conventional fuzzers operate under a single, fixed configuration throughout the fuzzing campaign, leaving the service’s rich configuration space unexplored. Incorporating configurations as a dynamic input dimension is challenging due to complex semantics, trigger conditions, and the resulting enlarged search space. We tackle the problem of finding bugs under non-default configurations, termed ConfBug, by designing a new fuzzer called NCFuzz. The non-default configurations can be uncommon but administrators may enable them, which cannot be exercised by conventional fuzzers. With the assumption that software documentation that describes configuration options is available, NCFuzz leverages two key observations: 1) software documentation contains rich information about configurations; 2) interactions between configuration and network messages can be tracked through code instrumentation and data-flow analysis. Using these insights, NCFuzz uses configuration knowledge and the relationships between configurations and network messages to guide the fuzzer toward new software states. The quality and completeness of the documentation will affect the effectiveness of NCFuzz. Evaluation on six network service implementations shows NCFuzz achieves higher coverage than baseline fuzzers. Five ConfBugs were discovered during fuzzing.