DFirmSan: A lightweight dynamic memory sanitizer for Linux-based firmware

Abstract

Vulnerabilities in Linux-based firmware present a significant risk to IoT security, with memory-related issues being especially hidden and dangerous. Despite substantial efforts to uncover firmware vulnerabilities through fuzzing, these methods are often ineffective in detecting memory vulnerabilities. To address this issue, prior research introduces sanitizers integrated into fuzzers. However, applying existing sanitizers to Linux-based firmware poses three significant challenges: First, embedded Linux systems lack robust memory protection and operate under tight performance constraints, making it difficult to detect “silent memory corruption”. Second, most binary sanitizers focus on executables, such as the main program (the core backend service programs handling requests), and fail to effectively monitor dynamically loaded libraries, which are often assumed to be trustworthy. Third, sanitizers that rely on global memory monitoring techniques, such as shadow memory or redzone, introduce substantial performance overhead. These mechanisms significantly slow down resource-constrained firmware, rendering fuzz testing impractical for IoT devices. This paper introduces DFirmSan, a lightweight dynamic memory sanitizer for Linux-based firmware. DFirmSan addresses key challenges in detecting memory vulnerabilities through a two-step process. First, the pre-analysis phase identifies service programs and vendor-customized libraries, analyzing them for sensitive function calls and key parameters. In the second step, dynamic memory corruption detection, DFirmSan leverages this information to perform targeted dynamic boundary checks during runtime, focusing on detecting memory flaws, particularly silent corruptions. To minimize overhead, DFirmSan focuses on selectively monitoring sensitive function parameters influenced by untrusted data, rather than tracking all memory variables. It further reduces false positives by dynamically adjusting parameter boundaries. We evaluate DFirmSan on 18 real-world firmware samples. By integrating DFirmSan, two advanced fuzzers detect 117 and 25 additional known CVEs, respectively. Besides, it helps uncover 4 CNVD zero-day vulnerabilities. Despite this enhanced capability, the impact on fuzzing speed remains minimal, with reductions of only 16.43% and 2.69%, well within acceptable limits. Moreover, DFirmSan maintains an impressively low false positive rate of under 0.35% for detecting memory corruption, further underscoring its practicality in real-world firmware.