  Trusted Execution Environments (TEEs) embedded in IoT devices provide a
deployable solution to secure IoT applications at the hardware level. By
design, in TEEs, the Trusted Operating System (Trusted OS) is the primary
component. It enables the TEE to use security-based design techniques, such as
data encryption and identity authentication. Once a Trusted OS has been
exploited, the TEE can no longer ensure security. However, Trusted OSes for IoT
devices have received little security analysis, which is challenging from
several perspectives: (1) Trusted OSes are closed-source and have an
unfavorable environment for sending test cases and collecting feedback. (2)
Trusted OSes have complex data structures and require a stateful workflow,
which limits existing vulnerability detection tools. To address the challenges,
we present SyzTrust, the first state-aware fuzzing framework for vetting the
security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted
framework to enable fuzzing Trusted OSes directly on IoT devices as well as
tracking state and code coverage non-invasively. SyzTrust utilizes composite
feedback to guide the fuzzer to effectively explore more states as well as to
increase the code coverage. We evaluate SyzTrust on Trusted OSes from three
major vendors: Samsung, Tsinglink Cloud, and Ali Cloud. These systems run on
Cortex M23/33 MCUs, which provide the necessary abstraction for embedded TEEs.
We discovered 70 previously unknown vulnerabilities in their Trusted OSes,
receiving 10 new CVEs so far. Furthermore, compared to the baseline, SyzTrust
has demonstrated significant improvements, including 66% higher code coverage,
651% higher state coverage, and 31% improved vulnerability-finding capability.
We report all discovered new vulnerabilities to vendors and open source
SyzTrust.
