Speed is Not All You Need When Fuzzing Stateful Network Servers

Current network protocol fuzzing is an efficient mechanism for uncovering protocol vulnerabilities, yet it faces several challenges. For instance, bugs in stateful protocols can significantly hinder the generation of effective fuzzing testcases. Additionally, factors such as network transmission and session synchronization can lead to substantial delays in the fuzzing process. However, we have observed a common phenomenon that existing fuzzing techniques often focus on optimizing either execution speed or state inference, but not both, which limits their overall effectiveness in analyzing protocol defects. We verify such a common issue by experimental analysis and seek to understand the specific reasons behind this. Then, we design an enhanced network protocol fuzzer that harnesses shared memory-based message transmission and session state synchronization to alleviate the heavy post-execution analysis in StateAFL state inference, named S<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>fuzzer, to optimize both speed and state inference simultaneously. Our experiments reveal that S<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>fuzzer enhances execution speed by 4.7x compared to StateAFL. Simultaneously, we find that S<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>Fuzzer can infer a more comprehensive state model. This leads to a 9.38% increase in code coverage and 371 additional crashes (1.42x) compared to StateAFL across tested programs. This state inference amplification, which has not been discovered in previous research, allows S<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup>fuzzer to reach nearly equivalent coverage and superior bug finding ability, even if its execution speed is merely 1/10 of HNPFuzzer, the latest speedup scheme.