关键词: 基板管理控制器, 固件安全, 固件仿真, 模糊测试, 漏洞分析

Abstract: The baseboard management controller (BMC) is a remote management component of servers with high system privileges, and its firmware security is crucial. Currently, opensource BMC firmware, such as OpenBMC, is favored due to its good compatibility, high openness, and shorter development cycles. Facing challenges such as limited computational resources and complex execution environments in firmware dynamic analysis, fuzzing technology combined with firmware emulation can effectively perform vulnerability analysis. However, existing tools mainly target simple closedsource embedded firmware and are not wellsuited for the complex structure of BMC firmware. This paper presents a buildin fuzzing framework, BMCfuzz, tailored for opensource BMC firmware, which supports generalpurpose program analysis tools. The framework relies on full system emulation, allowing generalpurpose fuzzing tools to be directly deployed in the emulated firmware, bypassing the complex emulation environment and directly working on firmware programs. Additionally, the framework leverages opensource features to enhance fuzzing efficiency through source code instrumentation. For complex network service programs that are difficult to emulate, this paper proposes a simple method for generating fuzzed network packet injections to handle fuzzed data input, enabling better emulation and analysis. Experimental results show that the framework’s execution efficiency is improved by 12.1 times, and code coverage is increased by 6.17 times compared to binary instrumentation methods, demonstrating better testing performance.

Key words: baseboard management controller, firmware security, firmware emulation, fuzzing, vulnerability analysis