Fuzzing Linux with Xen
Tamas K. Lengyel leverages Xen hypervisor VM-forking and Intel Processor Trace to create an ultra-high-speed hypervisor-level kernel fuzzing framework.
Summary
The Challenges of Operating System Kernel Fuzzing
Fuzzing complex OS kernels like Linux requires rapid state resets and accurate branch coverage collection without destabilizing the target system.
Leveraging Xen VM-Forking for Instant State Resets
Tamas K. Lengyel upstreamed VM-forking capabilities into the Xen hypervisor, enabling spinning up thousands of lightweight, copy-on-write virtual machine instances in sub-milliseconds.
Hardware-Assisted Coverage via Intel Processor Trace
Combining Virtual Machine Introspection (VMI) with Intel Processor Trace provides complete, non-intrusive instruction coverage telemetry without source code modification.
Discovering Zero-Days in Linux Kernel Subsystems
Lengyel demonstrates uncovering real-world memory corruption vulnerabilities in Linux filesystem drivers and system call handlers at tens of thousands of executions per second.
Related talks
OffensiveCon·48 min
Netanel Ben-Simon · Yoav Alon
20 - Netanel Ben-Simon, Yoav Alon - Bugs on the Windshield: Fuzzing the Windows Kernel.
OffensiveCon·53 min
Vitaly Nikolenko
18 - Vitaly Nikolenko - Concolic Testing for Kernel Fuzzing and Vulnerability Discovery.
Briefings·30 min
Sandro Rüegge · Johannes Wikner
Exploit developers detail multi-threaded race conditions in Windows kernel drivers to achieve arbitrary memory read-write and privilege escalation.