Syzballer: Kernel Fuzzing Based on Basic Block Weight and Multi-armed Bandit

Abstract

The Linux operating system is now extensively used on personal computers, cloud platforms, and enterprise servers. The security of the Linux kernel has also increased in importance. Several techniques, such as symbolic execution, data flow analysis, and reinforcement learning, have been adapted for vulnerability discovery in recent years. Among these techniques, fuzzing is the most widely used one. However, the ease of accessing each kernel code basic block has not been considered in previous research. This means many high-risk vulnerabilities cannot be detected. To solve this problem, we present Syzballer, a hybrid fuzzer that combines multi-armed bandits with basic block weight, which is calculated by traversing the control flow graph generated by the kernel source code. First, we compile the kernel source code into LLVM bitcode and use the static analysis tool SVF to compute the weight of each basic block. Then we launched the fuzzer and loaded the weight file. Finally, a multi-armed bandit machine model is used to dynamically alter the task and seed selection. To verify the effectiveness of Syzballer, we compared it with the two most popular kernel fuzzers, Syzkaller and Syzvegas. Experiments have demonstrated that our Syzballer has improved in terms of code coverage and vulnerability detection.