SyzRisk: A Change-Pattern-Based Continuous Kernel Regression Fuzzer
Syzbot continuously fuzzes the full Linux kernel to discover latent bugs. Yet, around 75% of recent kernel bugs are caused by recent patches, dubbed regression bugs. Regression fuzzing prioritizes inputs that target recently or frequently patched code. However, this heuristic breaks down in the kernel environment as there are too many patches (and therefore too many targets). To improve regression fuzzing, we note that certain code change patterns (e.g., modifying GOTO) carry more risk of introducing bugs than others. Leveraging this observation, we introduce SyzRisk, a continuous regression fuzzer for the kernel that stresses bug-prone code changes. SyzRisk introduces code change patterns that allow for identifying risky code changes. After systematically estimating the risk of suspected change patterns under various circumstances, SyzRisk assigns more weight to risky change patterns. Using the accumulated corpus from prior continuous fuzzing, SyzRisk further prioritizes mutation inputs based on the observed weights. We simulated the pattern creation from developers using 146 known Linux kernel root causes including 38 CVE root causes and collected 23 risky change patterns. The evaluation shows that the pattern-based weighting method highlights root-cause commits 3.60x more compared to the heuristic of simply targeting recent and frequent changes. Our evaluation of the Linux kernel v6.0 demonstrates that SyzRisk records a 61% speedup in bug exposure time compared to Syzkaller, while discovering the most complete set of bugs across all compared fuzzers.
2-s2.0-85199303403
EPFL
EPFL
Sharif University of Technology
Seoul National University
École Polytechnique Fédérale de Lausanne
2024-07-01
9798400704826
1480
1494
REVIEWED
EPFL
| Event name | Event acronym | Event place | Event date |
Singapore, Singapore | 2024-07-01 - 2024-07-05 | ||
| Funder | Funding(s) | Grant Number | Grant URL |
European Research Council | |||
European Union’s Horizon 2020 research and innovation program | 850868 | ||
SNSF | PCEGP2_-186974 | ||
| Show more | |||