一句话：提出 InSVDF，通过建模 DMA 接口内部状态并引入异步感知状态快照与深度感知种子保存，显著加速虚拟设备漏洞挖掘。
Hypervisor 为每台虚拟机模拟独立硬件资源，虚拟设备是其主接口，而其 DMA 接口用于与主机通信，一旦存在漏洞将危及整个虚拟化环境乃至宿主机安全。已有针对 DMA 的模糊测试工作因对 DMA 状态不敏感而效率受限，具体表现为交互时机不确定和交互深度不清晰两个问题。为此，本文提出 InSVDF——一种 DMA 接口状态感知的模糊测试引擎：它首先对 DMA 接口的接口内状态进行建模，并引入异步感知的状态快照机制以及深度感知的种子保存机制来引导测试。作者将 InSVDF 与当前最先进的模糊测试器进行对比评估，结果表明其漏洞发现速度显著提升，最优情况下可达 24.2 倍，并新发现 2 个漏洞，其中 1 个已被分配 CVE 编号。
Hypervisor is the core technology of virtualization for emulating independent hardware resources for each virtual machine. Virtual devices serve as the main interface of the hypervisor, making the security of virtual devices crucial, as any vulnerabilities can impact the entire virtualization environment and pose a threat to the host machine's security. Direct Memory Access (DMA) is the interface of virtual devices, enabling communication with the host machine. Recently, many efforts have focused on fuzzing against DMA to discover the hypervisor's vulnerabilities. However, the lack of sensitivity to the DMA state causes these efforts to be hindered in efficiency during fuzzing. Specifically, there are two main issues: the uncertain interaction moment and the unclear interaction depth. In this paper, we introduce InSVDF, a DMA interface stateaware fuzzing engine. InSVDF first models the intra-interface state of the DMA interface and incorporates an asynchronyaware state snapshot mechanism along with a depth-aware seed preservation mechanism. To validate our approach, we compare InSVDF with a state-of-the-art fuzzer. The results demonstrate that InSVDF significantly enhances vulnerability discovery speed, with improvements of up to 24.2 x in the best case. Furthermore, InSVDF has identified 2 new vulnerabilities, one of which has been assigned a CVE ID.
DOI 原文 ·
@inproceedings{paperbot8811,
title = {Insvdf: Interface-State-Aware Virtual Device Fuzzing},
author = {Zexiang Zhang and Gaoning Pan and Ruipeng Wang and Yiming Tao and Zulie Pan and Cheng Tu and Min Zhang and Yang Li and Yi Shen and Chunming Wu},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00190}
}