一句话：提出学习型白盒变异器，用机器学习预测有希望的内核测试变异，大幅提升模糊测试覆盖率发现与定向到达能力。
内核模糊测试依赖程序变异来自动生成新测试，但内核代码与用户态接口复杂，传统手工启发式很难找到能提升覆盖率或到达目标位置的变异。Snowplow 提出一种学习型白盒测试变异器，其核心是高效机器学习模型：给定待变异测试程序、当前内核代码覆盖率和期望覆盖目标，预测有希望的变异。论文在近期 Linux 内核上针对系统调用参数变异进行评测：24 小时模糊测试中，发现新覆盖率的速度提升 4.8~5.2 倍，总体覆盖率提高 7.0%~8.6%；7 天 campaign 发现 86 个此前未知的崩溃；定向模糊测试到达 19 个目标位置快 8.5 倍，并额外到达 SOTA 遗漏的 2 个位置。
Kernel fuzzers rely heavily on program mutation to automatically generate new test programs based on existing ones. In particular, program mutation can alter the test's control and data flow inside the kernel by inserting new system calls, changing the values of call arguments, or performing other program mutations. However, due to the complexity of the kernel code and its user-space interface, finding the effective mutation that can lead to the desired outcome such as increasing the coverage and reaching a target code location is extremely difficult, even with the widespread use of manually-crafted heuristics. This work proposes Snowplow, a kernel fuzzer that uses a learned white-box test mutator to enhance test mutation. The core of Snowplow is an efficient machine learning model that can learn to predict promising mutations given the test program to mutate, its kernel code coverage, and the desired coverage. Snowplow is demonstrated on argument mutations of the kernel tests, and evaluated on recent Linux kernel releases. When fuzzing the kernels for 24 hours, Snowplow shows a significant speedup of discovering new coverage (4.8x~5.2x) and achieves higher overall coverage (7.0%~8.6%). In a 7-day fuzzing campaign, Snowplow discovers 86 previously-unknown crashes. Furthermore, the learned mutator is shown to accelerate directed kernel fuzzing by reaching 19 target code locations 8.5x faster and two additional locations that are missed by the state-of-the-art directed kernel fuzzer.
@inproceedings{GongRA0M25,
title = {S
<scp>nowplow</scp>
: Effective Kernel Fuzzing with a Learned White-box Test Mutator},
author = {Sishuai Gong and Wang Rui and Deniz Altinbüken and Pedro Fonseca and Petros Maniatis},
booktitle = {ASPLOS},
year = {2025},
doi = {10.1145/3676641.3716019}
}