一句话：报告在企业级 Linux 发行版上部署 syzkaller 的工业实践，解决覆盖率缺失等挑战并发现 41 个未知漏洞。
覆盖率引导的内核模糊测试已被广泛用于发现内核漏洞，但由于应用与硬件环境的高度复杂性，如何将其部署到企业级 Linux 内核上仍缺乏研究。本文与企业开发者合作，在负责公司内部业务和外部服务的四个企业级 Linux 发行版上部署了覆盖率引导内核模糊测试。作者针对部署流行模糊测试工具 syzkaller 时遇到的突出挑战——覆盖率支持缺失、内核配置不一致、浅路径中的缺陷以及持续模糊测试的复杂性——提出了相应的工程解决方案。评估结果表明，该实践在企业级 Linux 内核中发现了 41 个可复现的先前未知漏洞，其中 6 个获得了美国国家漏洞数据库的 CVE 编号，涵盖导致 general protection fault、死锁和 use-after-free 等缺陷。
Coverage-guided kernel fuzzing is a widely-used technique that has helped kernel developers and testers discover numerous vulnerabilities. However, due to the high complexity of application and hardware environment, there is little study on deploying fuzzing to the enterprise-level Linux kernel. In this paper, collaborating with the enterprise developers, we present the industry practice to deploy kernel fuzzing on four different enterprise Linux distributions that are responsible for internal business and external services of the company. We have addressed the following outstanding challenges when deploying a popular kernel fuzzer, syzkaller, to these enterprise Linux distributions: coverage support absence, kernel configuration inconsistency, bugs in shallow paths, and continuous fuzzing complexity. This leads to a vulnerability detection of 41 reproducible bugs which are previous unknown in these enterprise Linux kernel and 6 bugs with CVE IDs in U.S. National Vulnerability Database, including flaws that cause general protection fault, deadlock, and use-after-free.
DOI 原文 ·
@inproceedings{paperbot5146,
title = {Industry practice of coverage-guided enterprise Linux kernel fuzzing},
author = {Heyuan Shi and Runzhe Wang and Ying Fu and Mingzhe Wang and Xiaohai Shi and Xun Jiao and Houbing Song and Yu Jiang and Jiaguang Sun},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3340460}
}