TCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing
summary
A fuzzing framework named TCP-Fuzz is built to test TCP stacks using dependency-based mutations for packet and syscall sequences, a branch transition metric for transition-guided fuzzing, and a differential checker that compares outputs across stacks. It runs against five stacks (TLDK, F-Stack, mTCP, FreeBSD TCP, Linux TCP), finds 56 real bugs (8 memory, 48 semantic), has 40 confirmations and 23 fixes, and covers far more branch transitions and finds more bugs than AFL-like and stateful fuzzers.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:07TCP Stacks
- 1:44Study
- 2:28Study Results
- 2:54TCP Features
- 4:05Key Techniques
- 4:25DependencyBased Strategy
- 4:55Dependency Rules
- 5:23State Transitions
- 6:02Branch Transition
- 7:02Differential Checker
- 7:43TCPFast
- 8:51TCP Files
- 9:11Test Results
- 9:32Bugs
- 10:17Comparison
- 11:07Test Coverage
- 12:15Conclusion
related talks
53mFuzz Testing for Fun and Profit
23mValidate your TCPIP stack on the embedded device
10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
31m“Fuzz or lose..."
53mFuzzing 101
40mPerformance and Testing of an Open Source Erlang TCP/IP Stack
25mEmpowering High Performance User Space Network Stack on Arm
36mThe Cost of Complexity: Different Vulnerabilities While Implementing the Same RFC