Industry Practice of Directed Kernel Fuzzing for Open-source Linux Distribution
Directed grey-box fuzzing is a widely used automatic testing technique that has helped developers test specific code space in the target program. Although many directed fuzzers are designed to test the Linux kernel, deploying directed kernel fuzzing for Linux distribution still remains, due to the complexity of industrial requirements and deployment environments. In this paper, we collaborate with developers from Alibaba and the OpenAnolis community to conduct an industry practice of deploying directed kernel fuzzing on the open-source Linux distribution: OpenAnolis. We highlight several typical challenges and provide corresponding solutions for deploying directed kernel fuzzing, including hard-to-enable target code, abundant irrelevant seeds in the corpus, Lack of system calls for proprietary features, hard-to-coordinate multiple directed fuzzers, automated crash analysis, and the complexity of continuous fuzzing. Our efforts enabled us to discover 11 previously unknown reproducible bugs on the Linux distribution within the OpenAnolis, including vulnerabilities that lead to deadlocks or system crashes.
Wed 30 OctDisplayed time zone: Pacific Time (US & Canada) change
15:30 - 16:30 | Fuzzing 2Industry Showcase / NIER Track / Research Papers at Magnoila Chair(s): Marcel Böhme MPI-SP, Bochum | ||
15:30 15mTalk | Differential Fuzzing for Data Distribution Service Programs with Dynamic Configuration Research Papers Dohyun Ryu The Pennsylvania State University, Giyeol Kim The Pennsylvania State University, Daeun Lee Pusan National University, Seongjin Kim The Pennsylvania State University, Seungjin Bae The Pennsylvania State University, Junghwan Rhee University of Central Oklahoma, Taegyu Kim The Pennsylvania State University | ||
15:45 15mTalk | Seeding and Mocking in White-Box Fuzzing Enterprise RPC APIs: An Industrial Case Study Industry Showcase Man Zhang Beihang University, China, Andrea Arcuri Kristiania University College and Oslo Metropolitan University, Piyun Teng Meituan, kaiming.xue Meituan, Wenhao Wang Meituan | ||
16:00 15mTalk | Industry Practice of Directed Kernel Fuzzing for Open-source Linux Distribution Industry Showcase Heyuan Shi Central South University, Shijun chen Central South University, Runzhe Wang Alibaba Group, Yuhan Chen Central South Sniversity, Weibo Zhang Central South University, Qiang Zhang Hunan University, Yuheng Shen Tsinghua University, Xiaohai Shi Alibaba Group, Chao Hu Central South University, Yu Jiang Tsinghua University | ||
16:15 10mTalk | Visualizing and Understanding the Internals of Fuzzing NIER Track Sriteja Kummita Fraunhofer Institute for Mechatronic Systems Design (Fraunhofer IEM), Zenong Zhang The University of Texas - Dallas, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM, Shiyi Wei University of Texas at Dallas | ||