一句话：PrIntFuzz 通过自动虚拟设备模拟与静态分析，模糊测试 Linux 驱动中此前难覆盖的探测代码和中断处理程序。
Linux 驱动与内核共享地址空间和特权，但代码规模更大、测试不足、攻击面更广；由于缺少真实硬件支持，现有模糊测试难以覆盖驱动探测初始化、中断处理等大量代码。本文提出 PrIntFuzz，一个高效通用的模糊测试框架，用于测试这些被忽视的驱动代码。它首先通过过程间、字段敏感、路径敏感和流敏感的静态分析从驱动中提取知识，再据此构建灵活的模拟器，支持设备探测、硬件中断模拟和设备 I/O 拦截，最后采用多维度模糊测试策略探索目标代码。原型成功模拟了 311 个虚拟 PCI、472 个虚拟 I2C 和 169 个虚拟 USB 设备，在对应驱动中发现 150 个 bug，已提交补丁中 59 个被合入。对照实验中，PrIntFuzz 在 Linux 5.10-rc6 上发现 99 个 bug，而最先进 fuzzer 仅发现 50 个；在最新内核上覆盖 11,968 个基本块，Syzkaller 仅覆盖 2,353 个。
Linux drivers share the same address space and privilege with the core of the kernel but have a much larger code base and attack surface. The Linux drivers are not well tested and have weaker security guarantees than the kernel. Missing support from hardware devices, existing fuzzing solutions fail to cover a large portion of the driver code, e.g., the initialization code and interrupt handlers. In this paper, we present PrIntFuzz, an efficient and universal fuzzing framework that can test the overlooked driver code, including the PRobing code and INTerrupt handlers. PrIntFuzz first extracts knowledge from the driver through inter-procedural field-sensitive, path-sensitive, and flow-sensitive static analysis. Then it utilizes the information to build a flexible and efficient simulator, which supports device probing, hardware interrupts emulation and device I/O interception. Lastly, PrIntFuzz applies a multi-dimension fuzzing strategy to explore the overlooked code. We have developed a prototype of PrIntFuzz and successfully simulated 311 virtual PCI (Peripheral Component Interconnect) devices, 472 virtual I2C (Inter-Integrated Circuit) devices, 169 virtual USB (Universal Serial Bus) devices, and found 150 bugs in the corresponding device drivers. We have submitted patches for these bugs to the Linux kernel community, and 59 patches have been merged so far. In a control experiment of Linux 5.10-rc6, PrIntFuzz found 99 bugs, while the state-of-the-art fuzzer only found 50. PrIntFuzz covers 11,968 basic blocks on the latest Linux kernel, while the state-of-the-art fuzzer Syzkaller only covers 2,353 basic blocks.
@inproceedings{paperbot7398,
title = {PrIntFuzz: fuzzing Linux drivers via automated virtual device simulation},
author = {Zheyu Ma and Bodong Zhao and Letu Ren and Zheming Li and Siqi Ma and Xiapu Luo and Chao Zhang},
booktitle = {ISSTA},
year = {2022},
doi = {10.1145/3533767.3534226}
}