No Grammar, No Problem: Towards Fuzzing the Linux Kernel without System-Call Descriptions

Abstract

—The integrity of the entire computing ecosystem depends on the security of our operating systems (OSes). Unfortunately, due to the scale and complexity of OS code, hundreds of security issues are found in OSes, every year [32]. As such, operating systems have constantly been prime use-cases for applying security-analysis tools. In recent years, fuzz-testing has appeared as the dominant technique for automatically finding security issues in software. As such, fuzzing has been adapted to find thousands of bugs in kernels [14]. However, modern OS fuzzers, such as Syzkaller, rely on precise, extensive, manually-created harnesses and grammars for each interface fuzzed within the kernel. Due to this reliance on grammars, current OS fuzzers are faced with scaling-issues. In this paper, we present F UZZ NG, our generic approach to fuzzing system-calls on OSes. Unlike Syzkaller, F UZZ NG does not require intricate descriptions of system-call interfaces in order to function. Instead F UZZ NG leverages fundamental kernel design features in order to reshape and simplify the fuzzer’s input-space. As such F UZZ NG only requires a small config, for each new target: essentially a list of files and system-call numbers the fuzzer should explore.