For a software system to be reliable, it must manage its resources properly. Failure to do so will result in unreliable behaviour: an application that leaks memory will eventually crash, a packet source that overloads a queue may cause other systems to fail, a process that consumes too many CPU cycles will degrade the performance of other processes and so on. Resource leaks or resource exhaustion are difficult to discover during testing as it may happen slowly over a long time. One approach for discovering issues with reliability, security and robustness is fuzzing (short for fuzz testing). Fuzzing can take many forms, depending on what type of system is to be tested and what kinds of bugs one is after. Black-box fuzzing is arguably the most flexible approach to fuzzing. Unfortunately, it suffers from a low efficiency that makes it slow at finding bugs such as resource leaks. In this paper we explore the topic of black-box fuzzing by modeling it as a multi-armed bandit problem, an important subclass of the general reinforcement learning problem. We believe that by utilizing a reinforcement learning framework, black-box fuzzing can be better understood and attention can be drawn to the field, which deserves to be studied more. We also implement a fuzzer according to our model and evaluate it against a toy implementation of a simple protocol with a known resource leak. Lastly, we apply our fuzzer in a real-world case study against two widely distributed implementations of the Link Layer Discovery Protocol (LLDP), a key component in critical infrastructure applications such as network management and network automation. Our results show that our fuzzer gradually learns how to effectively trigger the resource leak in the toy implementation, thereby speeding up the bug discovery process. In the case study, the fuzzer struggles to learn from the observations it makes about the test target. We believe this to be because of excessive delays between the actions the fuzzer takes during testing and their corresponding effects. Despite this, our fuzzer still manages to find one resource leak in each of the two LLDP implementations, one of which was previously unknown. With this paper, we have taken the first steps towards a better understanding of black-box fuzzing and that a new generation of smart and highly efficient black-box fuzzers is within reach.

To handle the complexity of modern technical systems, the operator often relies on some kind of graphical user interface software. Such software typically provides statistics, visualization and remote management capabilities to the operator. Today, this software is usually implemented using various web technologies. This lets operators monitor and manage the system in question with a tool familiar to most people today, namely their web browser. Unfortunately, web technology comes with plenty of intricate and unexpected caveats and flaws that can lead to unpredictable and sometimes even insecure behavior. In this paper, we focus on how one such obscure flaw, cross-channel scripting, can affect communications and service-provider networks. We provide a testing framework for detecting such flaws and use it to test four different open-source network management systems. Three vulnerabilities were found and acknowledged and fixed by the developers and one CVE was assigned.

Service providers are adopting open-source technology and open standards in their next-generation networks. This gives them great flexibility and spurs innovation. But it also means that they must ensure proper interoperability between components; otherwise, vulnerabilities might get introduced in their networks. Unfortunately, state-of-the-art vulnerability scanning tools are unable to handle the complexity of service provider networks. In this letter we show how interoperability issues between seemingly reliable components introduce an injection vulnerability that allows us to control a firewall-protected network management system. We also extend the state-of-the-art in black-box fuzzing to give service providers a tool for combating similar issues.

Fuzz testing has become the de facto standard for vulnerability discovery. State-of-the-art fuzzers employ a so-called gray-box approach,where coverage information is fed back to the fuzzer after each generated test case, thereby allowing it to effectivize its generationstrategy over time to find bugs deep within the code. Despite research efforts in recent years, networked applications have proven tobe notoriously difficult to fuzz efficiently and thoroughly. Modern fuzzers struggle with the complex environmental interactions andstatefulness associated with networked systems and subsequently, shortcuts are taken to ensure at least some degree of hardening.

In this paper we study 32 prominent protocol implementations that have been continuously fuzzed by OSS-Fuzz. We define metricsto measure fuzzing activity within a project and correlate our measurements with registered CVEs for discovered vulnerabilities. Our analysis show a strong correlation between fuzzing activity and registered CVEs within a project. However, by using the CWE-1000 analys framework, we show that the correlation is only strong for certain classes of vulnerabilities. From those observations, we areable to draw conclusions about what current fuzzing practices are lacking and where fuzzing research efforts need to be spent in thefuture.

This technical report is an extension of doi:10.1145/3672608.3707730, which has been published with ACM in the SAC 2025 conference proceedings.