Demystifying the Dependency Challenge in Kernel Fuzzing
Demystifying the Dependency Challenge in Kernel Fuzzing
复制标题
DOI：
10.1145/3510003.3510126
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Yu Hao;Hang Zhang;Guoren Li;Xingyun Du;Zhiyun Qian;A. A. Sani-A.
中科院分区：
文献类型：
--
作者：
Yu Hao;Hang Zhang;Guoren Li;Xingyun Du;Zhiyun Qian;A. A. Sani-A.
迄今为止，模糊测试操作系统内核仍然是一项艰巨的任务。一个已知的挑战是，大部分内核代码被锁定在特定的内核状态下，当前的内核模糊器在探索如此巨大的状态空间时效率低下。我们把这个问题称为依赖性挑战。虽然有一些研究试图解决依赖性的挑战，但依赖性的流行和分类从未被研究过。大多数以前的工作只是试图恢复依赖机会，每当他们是相对容易识别。在本文中，我们进行了大量的测量研究，系统地了解依赖背后的真实的挑战。令我们惊讶的是，我们发现，即使是模糊内核模块，未解决的依赖仍然占59% - 88%的未覆盖的分支。此外，我们表明，依赖性的挑战只是一个症状，而不是未能实现更多的覆盖率的根本原因。通过提炼和总结我们的研究结果，我们相信这项研究对核模糊的未来研究提供了有价值的指导。最后，我们提出了一些新的研究方向，直接基于测量研究中获得的见解。
Fuzz testing operating system kernels remains a daunting task to date. One known challenge is that much of the kernel code is locked under specific kernel states and current kernel fuzzers are not ef-fective in exploring such an enormous state space. We refer to this problem as the dependency challenge. Though there are some ef-forts trying to address the dependency challenge, the prevalence and categorization of dependencies have never been studied. Most prior work simply attempted to recover dependencies opportunisti-cally whenever they are relatively easy to recognize. In this paper, we undertake a substantial measurement study to systematically understand the real challenge behind dependencies. To our surprise, we show that even for well-fuzzed kernel modules, unresolved de-pendencies still account for 59% - 88% of the uncovered branches. Furthermore, we show that the dependency challenge is only a symptom rather than the root cause of failing to achieve more cov-erage. By distilling and summarizing our findings, we believe the research provides valuable guidance to future research in kernel fuzzing. Finally, we propose a number of novel research directions directly based on the insights gained from the measurement study.