PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation
Fri 22 Jul 2022 07:00 - 07:20 at ISSTA 1 - Session 2-13: Fuzzing and Friends B
Linux drivers share the same address space and privilege with the core of the kernel but have a much larger code base and attack surface. The Linux drivers are not well tested and have weaker security guarantees than the kernel. Missing support from hardware devices, existing fuzzing solutions fail to cover a large portion of the driver code, e.g., the initialization code and interrupt handlers. In this paper, we present PrIntFuzz, an efficient and universal fuzzing framework that can test the overlooked driver code, including the PRobing code and INTerrupt handlers. PrIntFuzz first extracts knowledge from the driver through inter-procedural field-sensitive, path-sensitive, and flow-sensitive static analysis. Then it utilizes the information to build a flexible and efficient simulator, which supports device probing, hardware interrupts emulation and device I/O interception. Lastly, PrIntFuzz applies a multi-dimension fuzzing strategy to explore the overlooked code. We have developed a prototype of PrIntFuzz and successfully simulated 311 virtual PCI (Peripheral Component Interconnect) devices, 472 virtual I2C (Inter-Integrated Circuit) devices, 169 virtual USB (Universal Serial Bus) devices, and found 150 bugs in the corresponding device drivers. We have submitted patches for these bugs to the Linux kernel community, and 59 patches have been merged so far. In a control experiment of Linux 5.10-rc6, PrIntFuzz found 99 bugs, while the state-of-the-art fuzzer only found 50. PrIntFuzz covers 11,968 basic blocks on the latest Linux kernel, while the state-of-the-art fuzzer Syzkaller only covers 2,353 basic blocks.
Wed 20 JulDisplayed time zone: Seoul change
18:00 - 19:00 | |||
18:00 20mTalk | Efficient Greybox Fuzzing of Applications in Linux-based IoT Devices via Enhanced User-mode Emulation Technical Papers Yaowen Zheng Nanyang Technological University; Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China;, Yuekang Li Nanyang Technological University, Cen Zhang Nanyang Technological University, Hongsong Zhu Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China; School of Cyber Security, University of Chinese Academy of Sciences, China, Yang Liu Nanyang Technological University, Limin Sun Beijing Key Laboratory of IOT Information Security Technology, Institute of Information Engineering, CAS, China; School of Cyber Security, University of Chinese Academy of Sciences, China DOI | ||
18:20 20mTalk | MDPFuzz: Testing Models Solving Markov Decision Processes Technical Papers Qi Pang HKUST, Yuanyuan Yuan The Hong Kong University of Science and Technology, Shuai Wang Hong Kong University of Science and Technology DOI | ||
18:40 20mTalk | PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation Technical Papers Zheyu Ma , Bodong Zhao Tsinghua University, Letu Ren Department of Computer Science and Technology, Tsinghua University, Zheming Li Tsinghua University, Siqi Ma the University of Queensland, Xiapu Luo Hong Kong Polytechnic University, Chao Zhang Tsinghua University DOI |
Fri 22 JulDisplayed time zone: Seoul change
07:00 - 08:00 | |||
07:00 20mTalk | PrIntFuzz: Fuzzing Linux Drivers via Automated Virtual Device Simulation Technical Papers Zheyu Ma , Bodong Zhao Tsinghua University, Letu Ren Department of Computer Science and Technology, Tsinghua University, Zheming Li Tsinghua University, Siqi Ma the University of Queensland, Xiapu Luo Hong Kong Polytechnic University, Chao Zhang Tsinghua University DOI | ||
07:20 20mTalk | SLIME: Program-sensitive Energy Allocation for Fuzzing Technical Papers Chenyang Lyu Zhejiang University, Hong Liang Zhejiang University, Shouling Ji Zhejiang University, Xuhong Zhang Zhejiang University, Binbin Zhao Georgia Institute of Technology, Meng Han Binjiang Institute of Zhejiang University & Zhejiang University, Yun Li Huawei Technologies Co., Ltd., Zhe Wang State Key Laboratory of Computer Architecture, Institute of Computing Technology, Chinese Academy of Sciences, Wenhai Wang Zhejiang University, Raheem Beyah Georgia Institute of Technology DOI | ||
07:40 20mTalk | TensileFuzz: Facilitating Seed Input Generation in Fuzzing via String Constraint Solving Technical Papers Xuwei Liu Purdue University, USA, Wei You Renmin University of China, Zhuo Zhang Purdue University, Xiangyu Zhang Purdue University DOI |