BlueHat IL 2020 - Netanel Ben-Simon & Yoav Alon - Bugs on the Windshield: Fuzzing the Windows Kernel

### Overview Security researchers Netanel Ben-Simon and Yoav Alon detail their journey adapting coverage-guided system call fuzzing to the Windows kernel. After experiencing success finding user-space parser vulnerabilities in software like Adobe Reader and Microsoft Edge, the researchers sought to find kernel vulnerabilities to construct full exploit chains. While initial exploration led them to kAFL, they determined that targeting binary parsers with raw blobs was less effective for discovering complex kernel bugs that rely on sequences of interdependent, structured system calls. Consequently, they turned to syzkaller, ported it to Windows, and targeted both Windows Subsystem for Linux (WSL) and the win32k subsystem.

### Key Topics - **Evolution of Fuzzing Approaches:** Moving from simple mutation fuzzers and AFL-style binary parsers to coverage-guided, grammar-based syscall fuzzing using syzkaller. - **Overcoming Platform Incompatibilities:** Porting syzkaller to Windows by leveraging Intel Processor Trace (Intel PT) via KVM patches for coverage collection, handling crash detection despite PatchGuard, and implementing crash deduplication via call stack retrieval. - **WSL as an Initial Target:** Testing the modified syzkaller on WSL's Pico processes and Pico provider drivers (`lxcore.sys` and `lxss.sys`) before advancing to core Windows kernel components. - **Targeting win32k:** Expanding syzkaller descriptions to model Windows GUI subsystem syscalls (`win32k.sys`, `win32kbase.sys`, and `win32kfull.sys`), overcoming missing semantic information in headers, and modeling complex objects like GDI shared handle tables. - **Exploitation Impact:** Chaining a win32k vulnerability with image formats like Enhanced Metafile (EMF) to demonstrate potential remote code execution (RCE).

### Technical Details To bridge the gap between syzkaller (native to Linux) and Windows, the researchers addressed several engineering challenges: - **Coverage Collection:** Because Windows lacks compile-time tracing tools like KCOV, they adapted kAFL's approach using hardware-assisted Intel PT within KVM, exposing a KCOV-like hypercall interface to the guest executor. Coverage was exported in DynamoRIO/drcov format and visualized using IDA Pro with the Lighthouse plugin. Multithreading coverage instability was resolved by allocating per-thread buffers via guest thread tracking in KVM. - **Bug Detection & Deduplication:** Patching `BugCheck` and `BugCheckEx` with hypercalls initially tripped PatchGuard (Kernel Patch Protection), causing `CRITICAL_STRUCTURE_CORRUPTION`. They resolved this by developing a dedicated driver called `panic_reporter` using `KeRegisterBugCheckCallback`. For deduplication, they ran a secondary Windows virtual machine to read guest OS memory and extract reliable call stacks, heavily inspired by Bochspwn. - **WSL Fuzzing:** Testing WSL required an SSH server, Driver Verifier with special pools for `lxcore` and `lxss`, and resolving issues like Windows Update reboots, Windows Defender interference, and CPU starvation. While this phase yielded four denial-of-service bugs and deadlocks, it surfaced no security vulnerabilities. - **win32k Grammar and Execution:** Moving to win32k, the executor was ported using MinGW tools (`gendef` and `dlltool`) to compile on Linux and support up to 12 parameters per syscall. Running the SSH daemon as an interactive startup application rather than Session 0 was necessary to reach win32k UI attack surfaces. To write syzkaller descriptions for win32k's undocumented APIs, they referenced leaked Windows NT/2000 source code, ReactOS, and the WRK. By teaching syzkaller to query and use global objects from the GDI shared handle table via pseudo-syscalls, they rapidly uncovered high-impact bugs.

### Takeaways Fuzzers require active guidance and semantic understanding rather than purely random inputs. Across roughly 1.5 months of CPU fuzzing on win32k, the researchers identified eight vulnerabilities (receiving six CVE assignments, one duplicate, and one pending), three denial-of-service bugs, and several deadlocks. They also demonstrated that because formats like EMF wrap GDI drawing commands directly, a local privilege escalation bug in `StretchBlt` could be leveraged via EMF files to achieve remote code execution in viewing applications.