.png){kind=icon}
Return
Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
.png){kind=icon}
OA
AI
DOI：10.1109/ACCESS.2021.3129062.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
The OS kernel, which has full system privileges, is an attractive attack surface. A kernel fuzzer that targets system calls in fuzzing is a popular tool for discovering kernel bugs that can induce kernel privilege escalation attacks. To the best of our knowledge, the relevance of code coverage, which is obtained by fuzzing, to the system call has not been studied yet. For instance, modern coverage-guided kernel fuzzers, such as Syzkaller, estimate code coverage by comparing the entire set of executed basic blocks (or edges) regardless of the system call relevancy. Our insight is that the system call relevancy could be an essential performance indicator for realizing kernel fuzzing. In this regard, this study aims to assess the system call-related code coverage of kernel fuzzers. For this purpose, we have developed a practical assessment system that leverages the Intel PT and KCOV and assessed the Linux kernel fuzzers, such as Syzkaller, Trinity, and ext4 fuzzer. The experiments on different kernel versions demonstrated that approximately 32,000-47,000 functions are implemented in the Linux kernel, and approximately 9.7-15.2% are related to the system call. Our finding is that fuzzers that achieve higher code coverage in conventional metrics do not execute more basic blocks related to system calls. Thus, we recommend that kernel fuzzers use both system call-related functions and regular basic blocks in coverage metrics to assess fuzzing performance or to improve coverage feedback.
Keywords:
Kernel
Codes
Computer bugs
Fuzzing
Linux
Tools
Licenses
Fuzzing
kernel fuzzing
evaluation
system call
code coverage
Journal
IF:
3.6
Papers:
9.8W
Citations:
29.4W
Organization
Cited Papers
ShareSaveShareSaveShareSaveα-Taxilin Interacts with Sorting Nexin 4 and Participates in the Recycling Pathway of Transferrin Receptor.png)
PLoS ONE
OAAI
PLoS ONEIF0
OAAIShareSavePharmacogenomic identification of small molecules for lineage specific manipulation of subventricular zone germinal activityPLOS BiologyOAAI
PLOS BiologyIF0
OAAIShareSaveShareSave
View more