Fuzzing NASA Core Flight System Software
Ronald Brobert applies American Fuzzy Lop (AFL) to NASA's Core Flight System (cFS), discovering memory corruption bugs in lunar lander and satellite telemetry apps.
Summary
The Architecture of NASA's Core Flight System
NASA’s Core Flight System (cFS) is an open-source flight software framework deployed on flagship space missions, including the Lunar Reconnaissance Orbiter and Parker Solar Probe.
Targeting Spacecraft Command and Telemetry Modules
Ronald Brobert investigates key cFS applications, including Command Ingest (CI_Lab) and Telemetry Output (TO_Lab), which process mission commands.
Instrumenting and Fuzzing Spacecraft Software with AFL
Brobert demonstrates setting up American Fuzzy Lop (AFL) test harnesses to fuzz cFS message decoders, discovering multiple buffer overflows and crash conditions.
Hardening Open-Source Flight Software for Space Missions
The author provides remediation patches and automated fuzzing workflows to help flight software engineers validate mission-critical payloads before launch.
Related talks
Black Hat·29 min
Presenters detail vulnerability discovery and exploitation in AFL's Blindspot and How to Resist AFL Fuzzing for Arbitrary ELF Binaries.
Black Hat·28 min
Presenters detail vulnerability discovery and exploitation in When Virtualization Encounter AFL: A Portable Virtual Device Fuzzing Framework with AFL.
Ekoparty Security Conference·39 min
Explores fuzzing: Finding your own bugs and 0days! ▪ Rodolpho Concurde ▪ Ekoparty 2021: Red Zone Space and evaluates key implications for security practitioners.