With the rapid growth of IoT, secure and efficient mesh networking has become essential. Thread has emerged as a key protocol, widely used in smart-home and commercial systems, and serving as a core transport layer in the Matter standard. This paper presents ThreadFuzzer, the first dedicated fuzzing framework for systematically testing Thread protocol implementations. By manipulating packets at the MLE layer, ThreadFuzzer enables fuzzing of both virtual OpenThread nodes and physical Thread devices. The framework incorporates multiple fuzzing strategies, including Random and Coverage-based fuzzers from CovFuzz, as well as a newly introduced TLV Inserter, designed specifically for TLV-structured MLE messages. These strategies are evaluated on the OpenThread stack using code-coverage and vulnerability-discovery metrics. The evaluation uncovered five previously unknown vulnerabilities in the OpenThread stack, several of which were successfully reproduced on commercial devices that rely on OpenThread. Moreover, ThreadFuzzer was benchmarked against an oracle AFL++ setup using the manually extended OSS-Fuzz harness from OpenThread, demonstrating strong effectiveness. These results demonstrate the practical utility of ThreadFuzzer while highlighting challenges and future directions in the wireless protocol fuzzing research space.

翻译：随着物联网的快速发展，安全高效的无状网络变得至关重要。Thread已成为关键协议，广泛应用于智能家居和商业系统，并作为Matter标准中的核心传输层。本文提出ThreadFuzzer，这是首个专门用于系统测试Thread协议实现的模糊测试框架。通过在MLE层操纵数据包，ThreadFuzzer能够对虚拟OpenThread节点和物理Thread设备进行模糊测试。该框架整合了多种模糊测试策略，包括CovFuzz中的随机和基于覆盖率的模糊器，以及新引入的专为TLV结构的MLE消息设计的TLV插入器。这些策略在OpenThread栈上使用代码覆盖率和漏洞发现指标进行了评估。评估结果在OpenThread栈中发现了五个先前未知的漏洞，其中多个漏洞在依赖OpenThread的商业设备上成功复现。此外，ThreadFuzzer还使用OpenThread的手动扩展OSS-Fuzz工具作为基准，与典范的AFL++设置进行了对比，展示了强大的有效性。这些结果证明了ThreadFuzzer的实际应用价值，同时突显了无线协议模糊测试研究领域的挑战和未来方向。