Embedded fuzzing: a review of challenges, tools, and solutions

Abstract

Fuzzing has become one of the best-established methods to uncover software bugs. Meanwhile, the market of embedded systems, which binds the software execution tightly to the very hardware architecture, has grown at a steady pace, and that pace is anticipated to become yet more sustained in the near future. Embedded systems also benefit from fuzzing, but the innumerable existing architectures and hardware peripherals complicate the development of general and usable approaches, hence a plethora of tools have recently appeared. Here comes a stringent need for a systematic review in the area of fuzzing approaches for embedded systems, which we term “embedded fuzzing” for brevity. The inclusion criteria chosen in this article are semi-objective in their coverage of the most relevant publication venues as well as of our personal judgement. The review rests on a formal definition we develop to represent the realm of embedded fuzzing. It continues by discussing the approaches that satisfy the inclusion criteria, then defines the relevant elements of comparison and groups the approaches according to how the execution environment is served to the system under test. The resulting review produces a table with 42 entries, which in turn supports discussion suggesting vast room for future research due to the limitations noted.

StructuredFuzzer: Fuzzing Structured Text-Based Control Logic Applications

“…Fuzzing is a technique for automatically discovering vulnerabilities in software by submitting some arbitrary combination of inputs to the test target to reveal how it responds [8,21]. Historically, first introduced by Barton Miller [22], fuzzing has since been used extensively and in diverse ways towards identifying various vulnerabilities in numerous kinds of software [9].…”

The progress, challenges, and perspectives of directed greybox fuzzing

“…In addition to surveys on common fuzzing, there are also surveys focused on subclasses of fuzzing. Eisele et al reviewed the fuzzing approaches for embedded systems [120]. They gave a formal definition of embedded fuzzing and grouped the approaches according to how the execution environment is served to the system under test.…”