CAJ | 학술논문

针对当前统一可扩展固件接口(UEFI)固件漏洞大幅增多，且缺乏高效漏洞检测系统的问题，提出面向UEFI固件的模糊测试系统，采用模糊测试技术检测固件漏洞。该系统复用了原UEFI下自我认证测试系统的测试框架，同时使用专门的子系统生成高针对性的测试数据，并基于UEFI固件的驱动-协议模型为测试用例提供统一的编程接口。以一个UEFI下实际的固件安全漏洞为例，揭示该系统检测固件安全漏洞的能力。实验结果表明，该模糊测试系统不仅可以简化测试用例的开发，而且编写的测试用例比自我认证测试系统提升了15%的代码覆盖率，能有效应用于UEFI固件深层、高危安全漏洞的检测。
침대당전통일가확전고건접구(UEFI)고건루동대폭증다，차결핍고효루동검측계통적문제，제출면향UEFI고건적모호측시계통，채용모호측시기술검측고건루동。해계통복용료원UEFI하자아인증측시계통적측시광가，동시사용전문적자계통생성고침대성적측시수거，병기우UEFI고건적구동-협의모형위측시용례제공통일적편정접구。이일개UEFI하실제적고건안전루동위례，게시해계통검측고건안전루동적능력。실험결과표명，해모호측시계통불부가이간화측시용례적개발，이차편사적측시용례비자아인증측시계통제승료15%적대마복개솔，능유효응용우UEFI고건심층、고위안전루동적검측。
With the increase of code vulnerabilities in Unified Extensible Firmware Interface(UEFI) firmware and the lack of effective vulnerability detection systems, this paper develops a fuzzy test system for UEFI firmware. It applies fuzzy test technique to UEFI firmware vulnerability detection. The system reuses test framework of Self Certification Test(SCT) system, generates test data through a special subsystem to ensure the quality and provides APIs for creating test cases. Also, the vulnerability detection capability of the system is revealed through real security vulnerability in UEFI firmware. Experimental results show that, test cases can be written more easily but with 15%higher code coverage than the SCT system based on this system, which ensures the ability to detect deep, high risk security vulnerabilities.