Speakers
Description
Coverage-guided fuzzing has proven to be highly effective at discovering Linux kernel vulnerabilities. Since its appearance in 2016, syzkaller - especially through the automated syzbot platform - has reported over 14,000 findings to the public kernel mailing lists.
Despite the success, traditional fuzzing methods struggle to reach deep code paths within complex kernel subsystems, even when provided with exact descriptions of the Linux kernel interfaces and fine-grained coverage feedback. Generating programs to reach deeply nested Linux kernel locations often requires a nuanced semantic understanding of target source code - a bottleneck that historically demanded substantial manual engineering. Now, the ever increasing capabilities of LLMs offer us the opportunity to address this problem in a fully automated manner.
We will present an intelligent, context-aware bug discovery workflow that integrates LLM-driven seed program generation with coverage-guided fuzzing using Syzkaller. By leveraging coverage feedback from the fuzzing engine, our approach selectively targets weakly covered Linux kernel regions and automatically synthesizes context-relevant seed programs to reach them. These seeds are subsequently fed back into the fuzzer, enabling coverage expansion into previously unexplored code regions and facilitating bug discovery.
In early experiments, we successfully increased the testing coverage of the USB subsystem from 12% to 19% on the syzbot platform, exercising over 12,000 previously uncovered basic blocks. In total, by injecting the discovered seeds into the syzkaller pipeline, we've already discovered 150+ new, reproducible kernel bugs, including numerous UAF, OOB accesses and memory leaks.
Benchmark testing of the seed program generation workflow has demonstrated that it can reach roughly 16% of previously never reached locations (a random sample of N=500). We are confident that further improvements and future LLM models will let us achieve even higher effectiveness.