Fizzle: A Framework for Deterministic and Reproducible Network Fuzzing

Networked systems regularly receive untrusted inputs. When improperly handled, adversaries thus have the ability to remotely crash or compromise such systems. While many techniques have been proposed to detect these vulnerabilities, their ability to handle asynchronous and nondeterministic behavior significantly limit their coverage of real systems. In this paper we present Fizzle, a high-performance deterministic simulation testing framework for fuzzing network applications. Fizzle interposes system library calls to enforce sequential execution for multi-threading, simulate multi-modal network connections, and control system randomization in a manner that is transparent to the target application. By tracking synchronization and I/O primitives, Fizzle deterministically identifies when an application has finished processing input, thereby dramatically expanding the suite of protocols that it can accurately fuzz relative to other approaches. We show that Fizzle maintains 100% stability across ProFuzzBench targets and highly concurrent applications including Unbound, Redis and Open5GS. This resultantly leads to improved coverage and newly discovered/disclosed CVEs for projects that have already been subject to fuzzing. Surprisingly, Fizzle significantly outperforms existing network fuzzers despite carrying out substantial bookkeeping of external state and enforcing sequential execution of threads, achieving up to 20x more executions per second. Fizzle is designed to be highly configurable to a variety of network inputs and integrates with both AFL++ and LibAFL; we release it as an open-source extensible framework for future network protocol research to be carried out in a deterministic and reproducible manner.