Fuzzing in a Memory Safe Verification Environment

This technical paper discusses the integration of security considerations throughout the software development life cycle through the 'Secure by Design' paradigm. It presents an innovative approach that combines memory-safe hardware, specifically the Capability Hardware Enhanced RISC Instructions (CHERI), with fuzz testing to enhance security verification in embedded real-time systems. The paper outlines the persistent issue of memory-related vulnerabilities, particularly in memory-unsafe programming languages like C and C++, which continue to dominate the landscape of software vulnerabilities. It details the limitations of conventional fuzzing techniques and address sanitizers in detecting certain classes of memory errors. The authors argue that the combination of CHERI architecture and fuzz testing can significantly improve the detection of memory safety vulnerabilities during early development stages. Experimental results are provided, demonstrating that this approach can identify vulnerabilities that traditional methods may overlook, thereby contributing to a more secure software development process.