No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions
No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions
复制标题
DOI：
10.14722/ndss.2023.24688
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Alexander Bulekov;Bandan Das;Stefan Hajnoczi;Manuel Egele
中科院分区：
文献类型：
--
作者：
Alexander Bulekov;Bandan Das;Stefan Hajnoczi;Manuel Egele
整个计算生态系统的完整性取决于我们的操作系统（OS）的安全性。不幸的是，由于操作系统代码的规模和复杂性，每年都会在操作系统中发现数百个安全问题[32]。因此，操作系统一直是应用安全分析工具的主要用例。近年来，模糊测试已成为自动发现软件安全问题的主要技术。因此，模糊已经被用来发现内核中的数千个错误[14]。然而，现代的操作系统模糊器，如Syzkaller，依赖于精确的，广泛的，手动创建的工具和语法，用于内核内的每个接口模糊化。由于这种对语法的依赖，当前的OS模糊器面临着缩放问题。在本文中，我们提出了F UZZ NG，我们的通用方法来模糊系统调用操作系统。与Syzkaller不同的是，F UZZ NG不需要复杂的系统调用接口描述就可以运行。相反，F UZZ NG利用基本的内核设计特性来重塑和简化模糊器的输入空间。因此，F UZZ NG只需要一个小的配置，对于每个新的目标：基本上是一个文件和系统调用编号的列表，模糊器应该探索。
—The integrity of the entire computing ecosystem depends on the security of our operating systems (OSes). Unfortunately, due to the scale and complexity of OS code, hundreds of security issues are found in OSes, every year [32]. As such, operating systems have constantly been prime use-cases for applying security-analysis tools. In recent years, fuzz-testing has appeared as the dominant technique for automatically finding security issues in software. As such, fuzzing has been adapted to find thousands of bugs in kernels [14]. However, modern OS fuzzers, such as Syzkaller, rely on precise, extensive, manually-created harnesses and grammars for each interface fuzzed within the kernel. Due to this reliance on grammars, current OS fuzzers are faced with scaling-issues. In this paper, we present F UZZ NG, our generic approach to fuzzing system-calls on OSes. Unlike Syzkaller, F UZZ NG does not require intricate descriptions of system-call interfaces in order to function. Instead F UZZ NG leverages fundamental kernel design features in order to reshape and simplify the fuzzer’s input-space. As such F UZZ NG only requires a small config, for each new target: essentially a list of files and system-call numbers the fuzzer should explore.