一句话：与阿里巴巴及 OpenAnolis 社区合作，将定向灰盒模糊测试落地于开源 Linux 发行版内核，解决工业部署挑战并发现 11 个新内核缺陷。
定向灰盒模糊测试被广泛用于自动测试目标程序中的特定代码区域，但将其部署到 Linux 内核的工业场景仍面临诸多困难。本文与阿里巴巴及 OpenAnolis 社区的开发者合作，针对开源 Linux 发行版开展定向内核模糊测试的工业实践。作者总结了部署过程中的典型挑战：目标相关的内核配置选项被禁用、无关初始种子拖慢模糊测试启动、缺乏对内核特性接口的模糊测试支持、模糊器独立执行削弱测试效果、崩溃分类与分析需要大量人工、难以集成到现有模糊测试框架。论文针对这些挑战给出了相应解决方案，并在 OpenAnolis Linux 发行版中发现 11 个此前未知的内核缺陷，涉及云原生特性、io_uring 及其他组件。
Directed grey-box fuzzing is a widely used automatic testing technique that has helped developers test specific code space in the target program. Although many directed fuzzers are designed to test the Linux kernel, challenges still remain due to the complexity of industrial requirements and deployment environments. In this paper, we collaborate with developers from Alibaba and the OpenAnolis community to conduct an industry practice of directed kernel fuzzing for open-source Linux distribution. We highlight typical challenges in deploying directed kernel fuzzing, including target-related kernel configuration options being disabled, unrelated initial seeds limiting fuzzing startup performance, no support for kernel feature interface fuzzing, independent fuzzer execution limiting fuzzing effectiveness, much manual work to triage and analyze crashes, and hard to integrate into the existing fuzzing framework. We provide solutions to these challenges, which allowed us to discover 11 previously unknown kernel bugs related to cloud-native features, io_uring, and other components in the OpenAnolis Linux distribution.
DOI 原文 ·
@inproceedings{paperbot8384,
title = {Industry Practice of Directed Kernel Fuzzing for Open-source Linux Distribution},
author = {Heyuan Shi and Shijun Chen and Runzhe Wang and Yuhan Chen and Weibo Zhang and Qiang Zhang and Yuheng Shen and Xiaohai Shi and Chao Hu and Yu Jiang},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695278}
}