Aplicação da Técnica Fuzzing em Testes da Implementação de Referência do SPDM

Automated tests performed during software development are capable of finding flaws early, preventing vulnerabilities ranging from denial of service to privilege escalation. In particular, these automated tests can be performed using the fuzzing technique, which coordinates the sending of unexpected inputs to the software under test. This paper presents preliminary results of spdmfuzzer, a fuzzer developed to test the reference implementation of the Security Protocols and Data Models (SPDM), a protocol that enables hardware and firmware attestation. In its current publicly available version, spdmfuzzer has already been able to find unexpected behaviors in the protocol implementation.