In recent years, fuzz testing has benefited from increased com-
putational power and important algorithmic advances, leading to
systems that have discovered many critical bugs and vulnerabilities
in production software. Despite these successes, not all applications
can be fuzzed efficiently. In particular, stateful applications such as
network protocol implementations are constrained by a low fuzzing
throughput and the need to develop complex fuzzing harnesses
that involve custom time delays and clean-up scripts.
In this paper, we present SnapFuzz, a novel fuzzing framework
for network applications. SnapFuzz offers a robust architecture
that transforms slow asynchronous network communication into
fast synchronous communication, snapshots the target at the latest
point at which it is safe to do so, speeds up file operations by
redirecting them to a custom in-memory filesystem, and removes
the need for many fragile modifications, such as configuring time
delays or writing clean-up scripts.
Using SnapFuzz, we fuzzed five popular networking applications:
LightFTP, TinyDTLS, Dnsmasq, LIVE555 and Dcmqrscp. We report
impressive performance speedups of 62.8 x, 41.2 x, 30.6 x, 24.6 x, and
8.4 x, respectively, with significantly simpler fuzzing harnesses in
all cases. Due to its advantages, SnapFuzz has also found 12 extra
crashes compared to AFLNet in these applications.