.png){kind=icon}
返回
Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2021.3129062.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
The OS kernel, which has full system privileges, is an attractive attack surface. A kernel fuzzer that targets system calls in fuzzing is a popular tool for discovering kernel bugs that can induce kernel privilege escalation attacks. To the best of our knowledge, the relevance of code coverage, which is obtained by fuzzing, to the system call has not been studied yet. For instance, modern coverage-guided kernel fuzzers, such as Syzkaller, estimate code coverage by comparing the entire set of executed basic blocks (or edges) regardless of the system call relevancy. Our insight is that the system call relevancy could be an essential performance indicator for realizing kernel fuzzing. In this regard, this study aims to assess the system call-related code coverage of kernel fuzzers. For this purpose, we have developed a practical assessment system that leverages the Intel PT and KCOV and assessed the Linux kernel fuzzers, such as Syzkaller, Trinity, and ext4 fuzzer. The experiments on different kernel versions demonstrated that approximately 32,000-47,000 functions are implemented in the Linux kernel, and approximately 9.7-15.2% are related to the system call. Our finding is that fuzzers that achieve higher code coverage in conventional metrics do not execute more basic blocks related to system calls. Thus, we recommend that kernel fuzzers use both system call-related functions and regular basic blocks in coverage metrics to assess fuzzing performance or to improve coverage feedback.
Keyword:
Kernel
Codes
Computer bugs
Fuzzing
Linux
Tools
Licenses
Fuzzing
kernel fuzzing
evaluation
system call
code coverage
期刊
IF:
3.6
论文数:
9.8W
被引数:
29.4W
机构
引用论文
α-Taxilin Interacts with Sorting Nexin 4 and Participates in the Recycling Pathway of Transferrin ReceptorΑ-紫杉素与分选Nexin 4相互作用并参与转铁蛋白受体的循环途径.png)
PLoS ONE
OAAI
PLoS ONEIF0
OAAI分享收藏The Psychological Impact of ‘Mild Lockdown’ in Japan during the COVID-19 Pandemic: A Nationwide Survey under a Declared State of Emergency新型冠状病毒肺炎大流行期间日本 “轻度封锁” 的心理影响: 宣布紧急状态下的全国性调查OAAI
OAAI分享收藏Pharmacogenomic identification of small molecules for lineage specific manipulation of subventricular zone germinal activity用于谱系特异性操纵脑室下区生发活动的小分子的药物基因组学鉴定PLOS BiologyOAAI
PLOS BiologyIF0
OAAI分享收藏
查看更多内容