一句话：提出由发行版特有运行时参数接口引导的 Linux 内核模糊测试器 RPG，发现 22 个新缺陷并提升分支覆盖率。
Linux 发行版内核常加入厂商特有扩展，其中许多运行时参数接口扩大了攻击面，但现有模糊测试工具难以系统测试这些接口：既难生成有效测试用例，也难将测试资源集中到相关代码。为此，本文提出 RPG，一种发行版特有运行时参数引导的内核模糊测试器。RPG 分三阶段工作：先提取发行版特有运行时参数接口；再利用 LLM 与调优软件数据库建模各参数范围，生成有意义的接口测试用例；最后基于发行版内核函数控制流图，引导模糊器生成与这些接口代码更相关的通用测试用例。作者在 Ubuntu 22.04、Fedora 42、OpenAnolis 8.8 和 OpenAnolis 23.1 上评估，发现 22 个未知缺陷（13 个为发行版特有），其中 15 个被确认、10 个被修复；分支覆盖率分别比 Syzkaller 和 Healer 高 20.4% 和 21.2%。
The Linux distribution kernel differs significantly from the mainline kernel, incorporating additional features and vendor-specific extensions. Among these additions, many runtime parameter interfaces are unique to distribution kernels, which expands the attack surface and increases the risk of potential vulnerabilities. Fuzzing has been used to assess Linux distributions, but existing tools cannot systematically test these distribution-specific interfaces due to two main challenges: (1) generating test cases for these runtime parameter interfaces, and (2) concentrating test resources on the distribution-specific interface code. To address these challenges, we propose RPG, a distribution-specific runtime parameter-guided kernel fuzzer. RPG operates in three phases: First, RPG extracts distribution-specific runtime parameter interfaces. Then, RPG uses LLM and tuning software databases to model each parameter range to generate meaningful interface test cases. Third, RPG utilizes the distribution kernel’s function control flow graph to guide the fuzzer to generate generic test cases that are more closely related to the distribution-specific interface code. We evaluated RPG on four Linux distribution kernels: Ubuntu 22.04, Fedora 42, OpenAnolis 8.8, and OpenAnolis 23.1. RPG detected 22 previously unknown bugs (13 distribution-specific), of which 15 were confirmed and 10 fixed by kernel maintainers. RPG also achieved 20.4% and 21.2% higher branch coverage than Syzkaller and Healer, respectively.
DOI 原文 ·
@inproceedings{paperbot9307,
title = {RPG: Linux Kernel Fuzzing Guided by Distribution-Specific Runtime Parameter Interfaces},
author = {Yuhan Chen and Yuheng Shen and Guoyu Yin and Fan Ding and Runzhe Wang and Tao Ma and Xiaohai Shi and Qiang Fu and Ying Fu and Heyuan Shi},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00299}
}