一句话：提出描述符感知的 USB 驱动模糊测试方法 DNAFuzz，依据 USB 规范建模描述符字段与语义并设计变异策略，显著提升测试用例质量并发现 15 个漏洞。
USB 驱动漏洞检测中，现有模糊测试方法生成输入时不考虑 USB 描述符的格式与语义，导致大量测试用例无法通过主机输入校验，测试效率低下。本文提出 DNAFuzz，一个生成描述符感知载荷的 USB 驱动模糊器：首先依据 USB 规范解析描述符的字段定义与 item 类型进行建模，再基于字段描述列表和语义信息设计变异策略来引导载荷生成，从而提升测试用例质量与模糊测试效果。作者在多个 Linux 内核版本的 USB 驱动上评估 DNAFuzz，并与 USBFuzz、Syzkaller 等先进模糊器比较：执行时间超过 2 秒的测试用例比例分别提升 358% 与 65%，并检测到 15 个 bug，其中 11 个已被维护者修复或确认。
USB is a widely used interface standard in modern operating systems for connecting computers to various external devices. External devices can launch attacks by injecting random data into the host via USB, causing memory errors or even system-level crashes. Fuzzing has been proven to be an effective method to detect USB driver vulnerabilities. However, existing fuzzing methods generate testing inputs without considering the format and semantics of USB descriptors, which define device functionality. As a result, many test cases fail to pass the host’s input validation mechanism, leading to ineffective testing.In this paper, we propose DNAFuzz, a USB driver fuzzer that generates descriptor-aware payloads. First, it utilizes USB specifications to parse the field definitions and item types of USB descriptors for modeling. Then, based on the field description list and semantic information, DNAFuzz designs mutation strategies to guide the generation of payloads. This approach improves the quality of test cases and the fuzzing effectiveness. Currently, we evaluated DNAFuzz on multiple versions of Linux kernel USB drivers and compared it with state-of-the-art fuzzers, including USBFuzz and Syzkaller. Results show that DNAFuzz significantly improves input quality, successfully increasing the proportion of tests with execution times exceeding 2 seconds by 358% and 65%. In addition, DNAFuzz detected 15 bugs, 11 of which have been fixed or confirmed by the corresponding maintainers.
DOI 原文 ·
@inproceedings{paperbot9419,
title = {DNAFuzz: Descriptor-Aware Fuzzing for USB Drivers},
author = {Zhengshu Wang and Peng He and Fuchen Ma and Yuanliang Chen and Shuoshuo Duan and Yiyuan Bai and Yu Jiang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00052}
}