一句话：提出 Tron，结合协议结构与运行时反馈合成系统调用—数据包输入序列，提升 Linux 内核网络栈模糊测试的覆盖率与缺陷发现能力。
Linux 内核网络栈广泛部署且常暴露于不可信输入，其复杂、有状态的特性使其成为安全漏洞高发区，尤其是由细微协议交互触发的缺陷。现有 fuzzer（如 syzkaller）虽能发现内核缺陷，但缺乏协议感知与协同输入，难以触达深层协议逻辑。本文提出 Tron，一种面向 Linux 内核网络栈的模糊测试工具。它基于协议结构合成系统调用与数据包的联合输入序列，并引入运行时反馈，从而探索依赖协议的状态转换与深层执行路径，应对双输入模糊测试中的根本挑战。作者在四个近期 Linux 内核版本上评估 Tron，并与 syzkaller 和 kernelGPT 对比。结果显示，Tron 的分支覆盖率分别提升 22.9% 与 12.1%，并发现 25 个此前未知的缺陷，其中 7 个已被修复，表明协议—系统调用输入合成能有效增强网络栈模糊测试并挖掘难以触达的内核协议实现缺陷。
The Linux kernel network stack is a critical component of modern operating systems, widely deployed across platforms and often exposed to untrusted inputs. Its complex and stateful nature makes it a frequent target of security vulnerabilities, particularly those triggered by subtle protocol interactions. While existing fuzzers like syzkaller have demonstrated strong capabilities in discovering kernel bugs, they face challenges in exercising deep protocol logic due to the lack of coordinated inputs and protocol awareness. In this paper, we present Tron, a tool designed for fuzzing the Linux kernel network stack. By synthesizing syscall–packet input sequences based on protocol structure and incorporating runtime feedback, Tron enables the exploration of protocol-dependent state transitions and deep execution paths. Our approach addresses the fundamental challenges in dual-input fuzzing by integrating protocol knowledge with execution feedback. We evaluate Tron on four recent Linux kernel versions and compare it against syzkaller and kernelGPT. The results show that Tron improves branch coverage by 22.9% and 12.1% over syzkaller and kernelGPT, respectively, and discovers 25 previously unknown bugs, 7 of which have been fixed. These results demonstrate the effectiveness of protocol–system call input synthesis in enhancing network stack fuzzing and uncovering hard-to-reach bugs in kernel protocol implementations.
DOI 原文 ·
@inproceedings{paperbot9319,
title = {Tron: Fuzzing Linux Network Stack via Protocol-System Call Payload Synthesis},
author = {Qiang Zhang and Yifei Chu and Yuheng Shen and Jianzhong Liu and Heyuan Shi and Yu Jiang and Wanli Chang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00266}
}