Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Conferences, Workshops, Symposiums, and Seminars
  4. SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer
 
conference paper

SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer

Lee, Gwangmu
•
Xu, Duo
•
Salimi, Solmaz
Show more
July 1, 2024
ACM AsiaCCS 2024 - Proceedings of the 19th ACM Asia Conference on Computer and Communications Security
19 ACM Asia Conference on Computer and Communications Security

Syzbot continuously fuzzes the full Linux kernel to discover latent bugs. Yet, around 75% of recent kernel bugs are caused by recent patches, dubbed regression bugs. Regression fuzzing prioritizes inputs that target recently or frequently patched code. However, this heuristic breaks down in the kernel environment as there are too many patches (and therefore too many targets). To improve regression fuzzing, we note that certain code change patterns (e.g., modifying GOTO) carry more risk of introducing bugs than others. Leveraging this observation, we introduce SyzRisk, a continuous regression fuzzer for the kernel that stresses bug-prone code changes. SyzRisk introduces code change patterns that allow for identifying risky code changes. After systematically estimating the risk of suspected change patterns under various circumstances, SyzRisk assigns more weight to risky change patterns. Using the accumulated corpus from prior continuous fuzzing, SyzRisk further prioritizes mutation inputs based on the observed weights. We simulated the pattern creation from developers using 146 known Linux kernel root causes including 38 CVE root causes and collected 23 risky change patterns. The evaluation shows that the pattern-based weighting method highlights root-cause commits 3.60x more compared to the heuristic of simply targeting recent and frequent changes. Our evaluation of the Linux kernel v6.0 demonstrates that SyzRisk records a 61% speedup in bug exposure time compared to Syzkaller, while discovering the most complete set of bugs across all compared fuzzers.

  • Details
  • Metrics
Type
conference paper
DOI
10.1145/3634737.3637642
Scopus ID

2-s2.0-85199303403

Author(s)
Lee, Gwangmu

EPFL

Xu, Duo

EPFL

Salimi, Solmaz

Sharif University of Technology

Lee, Byoungyoung

Seoul National University

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Date Issued

2024-07-01

Publisher

Association for Computing Machinery, Inc

Published in
ACM AsiaCCS 2024 - Proceedings of the 19th ACM Asia Conference on Computer and Communications Security
ISBN of the book

9798400704826

Start page

1480

End page

1494

Subjects

Code Analysis

•

Continuous Fuzzing

•

Development Study

•

Kernel Security

•

Regression Testing

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
Event nameEvent acronymEvent placeEvent date
19 ACM Asia Conference on Computer and Communications Security

Singapore, Singapore

2024-07-01 - 2024-07-05

FunderFunding(s)Grant NumberGrant URL

European Research Council

European Union’s Horizon 2020 research and innovation program

850868

SNSF

PCEGP2_-186974

Show more
Available on Infoscience
April 4, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/248580
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés