Automation Challenges and Solutions in Coverage-Guided Fuzzing of Multiprocess Software Systems
Modern software systems typically rely on multiprocess architectures to achieve scalability, fault isolation, and enhanced performance. Notable examples are web servers, database systems, and browsers, which handle incoming requests, user sessions, or plugins through separate processes. However, this distributed design introduces significant challenges for automated security testing methodologies.
Among the various automated security testing techniques, Coverage-Guided Fuzzing has been widely adopted for software vulnerability discovery. In brief, it leverages runtime code coverage as testcase execution feedback to drive mutation-based input generation with the objective of enhancing system exploration. Despite its effectiveness, current fuzzers are not designed to comprehensively test multiprocess software systems, creating blind spots in vulnerability detection.
In fact, existing fuzzers operate under the assumption of single-process execution within clear fuzzing loop boundaries. Multiprocess software systems break these assumptions: processes run concurrently, accept inputs through different inter-process communication mechanisms, code coverage scatters across multiple address spaces, and bugs occur in unmonitored child processes.
These limitations stem from a lack of fork-awareness: the capability to detect, trace, and coordinate testing across process boundaries created by fork() system calls. This dissertation addresses the automation challenges of coverage-guided fuzzing for multiprocess software systems.
The research identifies four core problems: execution synchronisation across concurrent processes, comprehensive test oracle design for multiprocess bug detection, coverage observation across distributed execution, and multi-input generation and injection through diverse inter-process communication mechanisms.
The primary contributions include: (1) empirical evidence demonstrating significantly lower coverage in multiprocess software within OSS-Fuzz projects, (2) the formal definition of fork-awareness and a systematic evaluation framework revealing fundamental limitations across fourteen state-of-the-art fuzzers, and (3) the design and implementation of ForkFuzz, the first fork-aware coverage-guided fuzzer that addresses three of the four core challenges through process tree monitoring, cross-process anomaly detection, and distributed coverage aggregation.
Ultimately, this work establishes the foundation for automated coverage-guided fuzzing of multiprocess software systems, with complementary contributions extending to specialised domains including stateful protocol testing and GraphQL API security assessment.
