一句话：提出 VD-Guard，结合静态控制流分析与 DMA 引导模糊测试，有效发现 hypervisor 虚拟设备漏洞。
虚拟化 hypervisor 通过虚拟设备共享物理资源，但虚拟设备的设计或实现缺陷会带来严重安全风险。现有动态漏洞检测方法因缺乏 MMIO/PIO 与 DMA 操作的关键信息，难以有效发现漏洞。VD-Guard 采用混合方法：先通过静态控制流分析追踪从虚拟设备数据入口点（MMIO/PIO 函数）到关键分发点（DMA 函数）的调用轨迹，并借助静态分析与有限模糊测试生成能触发这些轨迹的种子；再以这些种子为输入，进行 DMA 引导的模糊测试以发现缺陷。作者构建了包含 QEMU 中 10 个已知漏洞的数据集，VD-Guard 优于最先进的 hypervisor 模糊测试器 Morphuzz，并在 QEMU 和 VirtualBox 中发现 4 个新漏洞，均已确认和修复，其中 3 个获 CVE 编号。
Virtualization has been widely used in various scenarios, such as cloud computing. As its core technology, virtualization hypervisor brings up the efficiency of sharing the physical machine's resources via virtual devices. However, virtualization hypervisor also introduces significant security risks due to defective design or implementation schemes on virtual devices. Although several methods have been proposed to detect vulnerabilities in virtual devices, they still cannot effectively discover them because of missing critical information related to the MMIO/PIO and DMA operations to guide their dynamic methods. In this paper, we propose a hybrid method, VD-GUARD, to detect vulnerabilities in virtual devices. Specifically, it first leverages static control flow analysis to track call traces from various data entry points of virtual devices (MMIO/PIO functions) to the critical dispatcher points (DMA functions), and generate seeds that can trigger this call trace via static analysis and limited fuzzing test. And then, it takes these seeds as input and leverages DMA guided fuzzing to discover bugs. To verify the effectiveness of Vd-guard, we build a dataset, including 10 bugs in QEMU, based on previous works, and Vd-guardoutperforms the state-of-the-art hypervisor fuzzer Morphuzz. Vd-guardalso has found 4 new vulnerabilities in QEMU and VirtualBox, all of which have been confirmed and fixed (have been assigned 3 CVE IDs).
@inproceedings{LiuCXWCWZXS23,
title = {VD-Guard: DMA Guided Fuzzing for Hypervisor Virtual Device},
author = {Yuwei Liu and Siqi Chen and Yuchong Xie and Yanhao Wang and Libo Chen and Bin Wang and Yingming Zeng and Zhi Xue and Purui Su},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00051}
}