Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph

The OS kernel, which has full system privileges, is an attractive attack surface. A kernel fuzzer that targets system calls in fuzzing is a popular tool for discovering kernel bugs that can induce kernel privilege escalation attacks. To the best of our knowledge, the relevance of code coverage, whic...

Descripción completa

Guardado en:

Detalles Bibliográficos
Autores principales:	Mingi Cho, Hoyong Jin, Dohyeon An, Taekyoung Kwon
Formato:	article
Lenguaje:	EN
Publicado:	IEEE 2021
Materias:	Fuzzing kernel fuzzing evaluation system call code coverage Electrical engineering. Electronics. Nuclear engineering TK1-9971
Acceso en línea:	https://doaj.org/article/51e5d49257cb4291be5891fe52a43545
Etiquetas:	Agregar Etiqueta Sin Etiquetas, Sea el primero en etiquetar este registro!

id	oai:doaj.org-article:51e5d49257cb4291be5891fe52a43545
record_format	dspace
spelling	oai:doaj.org-article:51e5d49257cb4291be5891fe52a435452021-12-02T00:00:50ZEvaluating Code Coverage for Kernel Fuzzers via Function Call Graph2169-353610.1109/ACCESS.2021.3129062https://doaj.org/article/51e5d49257cb4291be5891fe52a435452021-01-01T00:00:00Zhttps://ieeexplore.ieee.org/document/9618942/https://doaj.org/toc/2169-3536The OS kernel, which has full system privileges, is an attractive attack surface. A kernel fuzzer that targets system calls in fuzzing is a popular tool for discovering kernel bugs that can induce kernel privilege escalation attacks. To the best of our knowledge, the relevance of code coverage, which is obtained by fuzzing, to the system call has not been studied yet. For instance, modern coverage-guided kernel fuzzers, such as Syzkaller, estimate code coverage by comparing the entire set of executed basic blocks (or edges) regardless of the system call relevancy. Our insight is that the system call relevancy could be an essential performance indicator for realizing kernel fuzzing. In this regard, this study aims to assess the system call-related code coverage of kernel fuzzers. For this purpose, we have developed a practical assessment system that leverages the Intel PT and KCOV and assessed the Linux kernel fuzzers, such as Syzkaller, Trinity, and ext4 fuzzer. The experiments on different kernel versions demonstrated that approximately 32,000–47,000 functions are implemented in the Linux kernel, and approximately 9.7–15.2% are related to the system call. Our finding is that fuzzers that achieve higher code coverage in conventional metrics do not execute more basic blocks related to system calls. Thus, we recommend that kernel fuzzers use both system call-related functions and regular basic blocks in coverage metrics to assess fuzzing performance or to improve coverage feedback.Mingi ChoHoyong JinDohyeon AnTaekyoung KwonIEEEarticleFuzzingkernel fuzzingevaluationsystem callcode coverageElectrical engineering. Electronics. Nuclear engineeringTK1-9971ENIEEE Access, Vol 9, Pp 157267-157277 (2021)
institution	DOAJ
collection	DOAJ
language	EN
topic	Fuzzing kernel fuzzing evaluation system call code coverage Electrical engineering. Electronics. Nuclear engineering TK1-9971
spellingShingle	Fuzzing kernel fuzzing evaluation system call code coverage Electrical engineering. Electronics. Nuclear engineering TK1-9971 Mingi Cho Hoyong Jin Dohyeon An Taekyoung Kwon Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
description	The OS kernel, which has full system privileges, is an attractive attack surface. A kernel fuzzer that targets system calls in fuzzing is a popular tool for discovering kernel bugs that can induce kernel privilege escalation attacks. To the best of our knowledge, the relevance of code coverage, which is obtained by fuzzing, to the system call has not been studied yet. For instance, modern coverage-guided kernel fuzzers, such as Syzkaller, estimate code coverage by comparing the entire set of executed basic blocks (or edges) regardless of the system call relevancy. Our insight is that the system call relevancy could be an essential performance indicator for realizing kernel fuzzing. In this regard, this study aims to assess the system call-related code coverage of kernel fuzzers. For this purpose, we have developed a practical assessment system that leverages the Intel PT and KCOV and assessed the Linux kernel fuzzers, such as Syzkaller, Trinity, and ext4 fuzzer. The experiments on different kernel versions demonstrated that approximately 32,000–47,000 functions are implemented in the Linux kernel, and approximately 9.7–15.2% are related to the system call. Our finding is that fuzzers that achieve higher code coverage in conventional metrics do not execute more basic blocks related to system calls. Thus, we recommend that kernel fuzzers use both system call-related functions and regular basic blocks in coverage metrics to assess fuzzing performance or to improve coverage feedback.
format	article
author	Mingi Cho Hoyong Jin Dohyeon An Taekyoung Kwon
author_facet	Mingi Cho Hoyong Jin Dohyeon An Taekyoung Kwon
author_sort	Mingi Cho
title	Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
title_short	Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
title_full	Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
title_fullStr	Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
title_full_unstemmed	Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph
title_sort	evaluating code coverage for kernel fuzzers via function call graph
publisher	IEEE
publishDate	2021
url	https://doaj.org/article/51e5d49257cb4291be5891fe52a43545
work_keys_str_mv	AT mingicho evaluatingcodecoverageforkernelfuzzersviafunctioncallgraph AT hoyongjin evaluatingcodecoverageforkernelfuzzersviafunctioncallgraph AT dohyeonan evaluatingcodecoverageforkernelfuzzersviafunctioncallgraph AT taekyoungkwon evaluatingcodecoverageforkernelfuzzersviafunctioncallgraph
_version_	1718403983119220736

Evaluating Code Coverage for Kernel Fuzzers via Function Call Graph

Ejemplares similares