💻 computer science

MulCovFuzz: A Multi-Component Coverage-Guided Greybox Fuzzer for 5G Protocol Testing

This paper introduces MulCovFuzz, a novel multi-component coverage-guided greybox fuzzer for 5G protocol testing that outperforms traditional methods by dynamically monitoring code coverage across system components, ultimately achieving significant improvements in coverage and vulnerability discovery on the OpenAirInterface implementation.

Original authors: Yu Wang, Yang Xiang, Chandra Thapa, Hajime Suzuki

Published 2026-02-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yu Wang, Yang Xiang, Chandra Thapa, Hajime Suzuki

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the 5G network as a massive, futuristic city where billions of people (devices) are constantly talking to each other. This city is built by many different specialized departments (like the Police, the Traffic Control, and the Power Grid) that must work together perfectly. If one department makes a mistake, the whole city could crash, leading to chaos, lost data, or even financial fraud.

For a long time, security experts tried to find mistakes in this city by acting like blindfolded tourists. They would throw random rocks (test messages) at the buildings and see if anything broke. If a window shattered, they knew there was a problem. But because they were blindfolded, they couldn't see which rooms the rocks hit, or if a rock bounced off a wall and accidentally broke a pipe in a different building. They were guessing in the dark.

This paper introduces a new tool called MulCovFuzz, which is like giving those tourists super-vision goggles and a team of scouts.

Here is how it works, broken down simply:

1. The Problem: The "Blindfolded" Approach

Traditional security tools (called "black-box fuzzers") just send random messages to the main building (the AMF) and wait to see if it crashes.

The Analogy: Imagine trying to find a hidden trap in a maze by throwing a ball at the entrance. If the ball hits a wall, you know the wall is there. But if the ball hits a secret lever that opens a door in a different part of the maze, the person at the entrance has no idea. They miss the trap because they can't see inside the other rooms.
The Reality: In 5G, different parts of the network talk to each other. A mistake often happens only when two or three different departments interact in a weird way. Traditional tools miss these because they only look at one department at a time.

2. The Solution: The "Super-Vision" Goggles (Multi-Component Coverage)

MulCovFuzz changes the game by installing cameras in every room of the city, not just the entrance.

The Analogy: Instead of just watching the front door, MulCovFuzz has a scout in the Police Station, the Traffic Center, and the Power Grid. When you throw a rock (send a test message), these scouts instantly report back: "Hey! That rock didn't just hit the door; it traveled through the hallway, triggered a light switch in the Traffic Center, and almost tripped a wire in the Power Grid!"
The Tech: It uses a special "instrumentation" (like invisible sensors) on every part of the 5G system. It tracks exactly which lines of code are being used across the whole network, not just in one spot.

3. The Smart Brain: The Scoring System

Now that the tool sees everything, it needs to decide which rocks to throw next. It uses a Smart Scoring System.

The Analogy: Imagine a game where you get points not just for hitting a target, but for hitting targets that are hard to reach or for hitting targets that cause a chain reaction.
- If a rock hits a common wall, you get 1 point.
- If a rock hits a secret lever that makes the lights flicker in three different buildings, you get 100 points.
The Result: The tool learns to throw more rocks at the "secret levers" because the score tells it, "This is interesting! Let's try to break this specific chain of events!" This helps it find deep, hidden bugs that random guessing would never find.

4. The Results: Finding the Hidden Traps

The authors tested this new tool on a real, open-source 5G network (called OpenAirInterface).

The Win: Compared to the old "blindfolded" tools, MulCovFuzz found 5.85% more code paths and 16% more crashes.
The Big Discovery: It found three brand-new, zero-day vulnerabilities (secret traps that no one knew existed). Two of these were so tricky that no other tool could find them. One of them was a "Heap Buffer Overflow," which is like a bucket that overflows and spills dangerous water everywhere, potentially letting hackers take control.

Summary

Think of MulCovFuzz as a detective with a drone.

Old Way: The detective stands at the front door and yells random questions, hoping someone screams back.
MulCovFuzz: The detective flies a drone over the whole city. When a weird noise happens in the basement, the drone sees it, maps the path the noise took, and tells the detective exactly where to look next.

By watching the whole system work together, MulCovFuzz makes our 5G networks much safer, ensuring that the digital backbone of our future doesn't collapse under pressure.

1. Problem Statement

As mobile networks transition to 5G, the architecture has evolved into a complex, cloud-native, Service-Based Architecture (SBA) involving distributed Network Functions (NFs) such as the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF).

Limitations of Current Approaches: Traditional security testing for 5G relies heavily on black-box fuzzing or single-component greybox fuzzing.
- Black-box: Cannot observe internal program states or code coverage, leading to inefficient exploration.
- Single-component Greybox: Tools like AFLNet focus only on the System Under Test (SUT, e.g., AMF) and ignore the state of interacting components (e.g., SMF, NRF).
The Core Challenge: 5G protocols rely on intricate interdependencies between components. Certain critical code paths (e.g., error handling or complex corner cases) are only reachable when specific internal states across multiple components are synchronized. Traditional fuzzers fail to trigger these paths because they lack visibility into the ripple effects of a test input across the distributed system.

2. Methodology: MulCovFuzz

MulCovFuzz is a novel multi-component coverage-guided greybox fuzzer designed specifically for the 5G core network. It addresses the limitations above by monitoring code coverage across multiple distributed components simultaneously to guide test case generation.

A. System Architecture

The framework operates with the AMF as the primary target, interacting with other NFs (SMF, NRF, UPF) over standard 5G interfaces (e.g., N2, N4). It utilizes three feedback channels:

Message Feedback: Sends inputs via N2 (SCTP) and receives responses.
Signal Feedback: Monitors the runtime status (crashes/abnormal terminations) of the AMF process.
Coverage Feedback: The core innovation. It collects code coverage data not just from the AMF, but from all interacting components.

B. Multi-Component Coverage Collection Module (MCCM)

To handle the latency and overhead of distributed monitoring, the authors designed a specialized module consisting of three parts:

Controller: Orchestrates the collection process. It receives a request from the fuzzer when a new path is found in the AMF and triggers remote collection from other components.
Collector: Deployed alongside each target component (in containers). It reads the local Shared Memory (SHM) coverage bitmap generated by instrumentation and sends it back to the Controller.
Launcher: Manages the runtime environment, ensuring containers are running and SHM segments are correctly initialized for instrumentation.
Instrumentation: Uses afl-clang-fast (LLVM-based) to instrument key NFs (AMF, SMF, UPF, NRF, NEF). Coverage is tracked using 8-level logarithmic buckets (0-7) similar to AFL, stored in SHM.

C. Scoring Function & Scheduling

MulCovFuzz introduces a novel scoring function to determine which test seeds deserve more "energy" (execution time). The score $S(t)$ combines:

Coverage Reward ( $R_c$ ): A weighted sum of coverage gains across all instrumented channels (components).
Efficiency Reward ( $R_e$ ): Based on execution time and total coverage gain.

$S(t) = w_1 R_c(t) + w_2 R_e(t)$

This ensures the fuzzer prioritizes inputs that trigger new paths across multiple components, rather than just the target component, effectively exploring complex interaction scenarios.

3. Key Contributions

Novel Fuzzing Paradigm: The first coverage-guided greybox fuzzer for 5G that dynamically adapts strategies based on multi-component coverage information, rather than relying solely on the SUT's response or single-component coverage.
Multi-Component Coverage Mechanism: A system to collect and aggregate coverage data from distributed, containerized network functions (AMF, SMF, NRF, UPF) in real-time with minimal overhead.
Energy Scoring Function: A mathematical model that balances coverage discovery across components with execution efficiency to guide seed selection.
Comprehensive Evaluation: Implementation and testing on the open-source OpenAirInterface (OAI) 5G core.

4. Experimental Results

The tool was evaluated against the baseline AFLNet (a state-of-the-art greybox fuzzer) on the OAI-AMF implementation over 24-hour trials.

Code Coverage Improvement:
- Branch Coverage: Increased by 5.85%.
- Line Coverage: Increased by 7.17%.
- Significance: This indicates MulCovFuzz successfully reached deeper, more complex execution paths that traditional fuzzers missed.
Crash Discovery:
- Achieved a 16% improvement in unique crash discovery (approx. 2900 unique crashes vs. 2500 for AFLNet).
Vulnerability Discovery:
- Uncovered three zero-day vulnerabilities in OAI-AMF:
  1. Null Pointer Dereference (in sctp_server.cpp): Found 10x faster than AFLNet.
  2. Uncaught Exception (in itti.cpp): Found by MulCovFuzz; AFLNet failed to find it in 24h.
  3. Heap Buffer Overflow (in 5gsMobileIdentity.cpp): Found by MulCovFuzz; AFLNet failed to find it in 24h.
- Two of these vulnerabilities were not identified by any other fuzzing technique in the study.

5. Significance and Impact

Security for Next-Gen Networks: As 5G becomes the backbone for critical infrastructure, IoT, and edge computing, the ability to find deep, interaction-based vulnerabilities is critical. MulCovFuzz demonstrates that ignoring component interdependencies leaves critical security gaps.
Methodological Advancement: The paper proves that "ripple effects" in distributed systems can be captured and utilized to guide fuzzing. The synchronized coverage spikes observed across components confirm that inputs triggering interesting behaviors in one component often propagate to others.
Practical Application: The tool successfully identified vulnerabilities that required precise state coordination across the AMF, SMF, and NRF, proving that multi-component feedback is essential for testing modern, service-based network architectures.

In conclusion, MulCovFuzz represents a significant leap forward in 5G security testing, moving from isolated component testing to a holistic, system-wide approach that effectively uncovers complex, state-dependent vulnerabilities.