SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel
Abstract
Fuzzing has become one of the most effective bug finding approach for software. In recent years, 24*7 continuous fuzzing platforms have emerged to test critical pieces of software, e.g., Linux kernel. Though capable of discovering many bugs and providing reproducers (e.g., proof-of-concepts), a major problem is that they neglect a critical function that should have been built-in, i.e., evaluation of a bug's security impact. It is well-known that the lack of understanding of security impact can lead to delayed bug fixes as well as patch propagation. In this paper, we develop SyzScope, a system that can automatically uncover new "high-risk" impacts given a bug with seemingly "low-risk" impacts. From analyzing over a thousand low-risk bugs on syzbot, SyzScope successfully determined that 183 low-risk bugs (more than 15%) in fact contain high-risk impacts, e.g., control flow hijack and arbitrary memory write, some of which still do not have patches available yet.
Keywords
Cite
@article{arxiv.2111.06002,
title = {SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel},
author = {Xiaochen Zou and Guoren Li and Weiteng Chen and Hang Zhang and Zhiyun Qian},
journal= {arXiv preprint arXiv:2111.06002},
year = {2021}
}
Comments
17 pages, 9 figures; accepted to USENIX Security 2022