Embedded Network Stacks (ENS) enable low-resource devices to communicate with the outside world, facilitating the development of the Internet of Things and Cyber-Physical Systems. Some defects in ENS are thus high-severity cybersecurity vulnerabilities: they are remotely triggerable and can impact the physical world. While prior research has shed light on the characteristics of defects in many classes of software systems, no study has described the properties of ENS defects nor identified a systematic technique to expose them. The most common automated approach to detecting ENS defects is feedback-driven randomized dynamic analysis ("fuzzing"), a costly and unpredictable technique. This paper provides the first systematic characterization of cybersecurity vulnerabilities in ENS. We analyzed 61 vulnerabilities across 6 open-source ENS. Most of these ENS defects are concentrated in the transport and network layers of the network stack, require reaching different states in the network protocol, and can be triggered by only 1-2 modifications to a single packet. We therefore propose a novel systematic testing framework that focuses on the transport and network layers, uses seeds that cover a network protocol's states, and systematically modifies packet fields. We evaluated this framework on 4 ENS and replicated 12 of the 14 reported IP/TCP/UDP vulnerabilities. On recent versions of these ENSs, it discovered 7 novel defects (6 assigned CVES) during a bounded systematic test that covered all protocol states and made up to 3 modifications per packet. We found defects in 3 of the 4 ENS we tested that had not been found by prior fuzzing research. Our results suggest that fuzzing should be deferred until after systematic testing is employed.

翻译：嵌入式网络栈（ENS）使低资源设备能够与外部世界通信，从而促进物联网和信息物理系统的发展。因此，ENS中的某些缺陷属于高严重性网络安全漏洞：它们可远程触发并可能影响物理世界。尽管先前的研究已阐明了多类软件系统中缺陷的特征，但尚无研究描述ENS缺陷的特性或识别出系统化的暴露方法。检测ENS缺陷最常用的自动化方法是基于反馈的随机化动态分析（"模糊测试"），这是一种成本高昂且不可预测的技术。本文首次对ENS中的网络安全漏洞进行了系统化特征描述。我们分析了6个开源ENS中的61个漏洞。这些ENS缺陷大多集中在网络栈的传输层和网络层，需要达到网络协议中的不同状态，且仅需对单个数据包进行1-2次修改即可触发。因此，我们提出了一种新颖的系统化测试框架，该框架聚焦于传输层和网络层，使用覆盖网络协议状态的种子，并系统化地修改数据包字段。我们在4个ENS上评估了该框架，并复现了14个已报告的IP/TCP/UDP漏洞中的12个。在这些ENS的最新版本上，我们的框架在一次覆盖所有协议状态且每数据包最多进行3次修改的系统化边界测试中，发现了7个新缺陷（其中6个已分配CVE编号）。我们在测试的4个ENS中的3个中发现了先前模糊测试研究未发现的缺陷。我们的结果表明，在采用系统化测试之前应推迟使用模糊测试。