RTCON: Context-Adaptive Function-Level Fuzzing for RTOS Kernels

—Real-Time Operating System (RTOS) is widely used in embedded systems with its various subsystems such as Blue-tooth and Wi-Fi. As its functionalities grow, its attack surface also expands, exposing it to more security threats. To address this, dynamic testing techniques like fuzzing have been widely applied to embedded systems. However, for RTOS, these techniques struggle to effectively test deeply located functions within the kernel due to their complexity. In this paper, we present RTC ON , a context-adaptive function-level fuzzer for RTOS kernels. RTC ON performs function-level fuzzing on any target functions within the RTOS kernel by adaptively generating function contexts during fuzzing. Additionally, RTC ON employs Multi-layer Classification to classify crashes by confidence levels, helping analysts focus on high-confidence crashes. We implemented the prototype of RTC ON and evaluated it on four popular RTOS kernels: Zephyr, RIOT, FreeRTOS, and ThreadX. As a result, RTC ON discovered 27 bugs, including 25 new bugs. We reported all of them to maintainers and received 14 CVEs. RTC ON also demonstrated its effectiveness in crash classification, achieving a 92.7% precision for high-confidence crashes, compared to a 5.8% precision for low-confidence crashes.