一句话：通过内核镜像复制等三项优化，在不改变模糊测试算法的前提下将 Syzkaller 提速 2.8 倍。
Syzkaller 是当前最先进的内核模糊测试器之一，但其测试吞吐量远低于用户态模糊测试器，制约了自身及基于它的模糊测试器的效率。本文对 Syzkaller 进行性能剖析，发现主要开销来自程序隔离与内核插桩，为此提出内核镜像复制及三项优化技术以降低这些开销，并实现为 Thunderkaller。该方案不改变也不依赖模糊测试算法，与 Syzkaller 的其他改进正交。评估表明，24 小时内 Thunderkaller 相比原版 Syzkaller 提速 2.8 倍，基本块覆盖率提升 25.8%，多发现 21 个独特漏洞，常见漏洞触发速度提升 6.3 倍；长期模糊测试中发现 6 个独特的 Linux 内核漏洞并获得一个 CVE。
Fuzzing is widely adopted to discover vulnerabilities in software, including the kernel. One of the most popular and state-of-the-art fuzzers for kernels is Syzkaller. However, Syzkaller has a much lower testing throughput compared to other user-space fuzzers, which affects the efficiency of both Syzkaller and other Syzkaller-based fuzzers. In this paper, we profiled the performance of Syzkaller, recognized that the major cost comes from program isolation and kernel instrumentation, and then proposed kernel image duplication and three optimization techniques to mitigate such overheads and present the solution Thunderkaller. Our solution does not change or depend on the fuzzing algorithm in any way, orthogonal to other refinements to Syzkaller. Our evaluation shows that, in 24 hours, Thunderkaller speeds up 2.8× compared to vanilla Syzkaller, achieves 25.8% more basic block coverage, detects 21 more unique bugs, and triggers the common bugs 6.3× faster. In a long time of fuzzing, we have found 6 unique Linux kernel bugs and obtained a CVE.