linux-kernel - Announcing a user-space Linux kernel fuzzer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAE5jQCc_s2KAaPcsK1_ZH-S_JV-FnzYeqCAjnbGrn0XzosntGw@mail.gmail.com>
Date:   Tue, 26 Nov 2019 17:32:35 +0300
From:   Anatoly Trosinenko <anatoly.trosinenko@...il.com>
To:     lkml <linux-kernel@...r.kernel.org>
Cc:     wen.xu@...ech.edu
Subject: Announcing a user-space Linux kernel fuzzer

Hello,

Here is a (yet another) fast Linux kernel fuzzer:
https://github.com/atrosinenko/kbdysch. It is a collection of fuzzing
harnesses utilizing LKL (Linux Kernel Library) as a kernel to be
tested.

While it was developed independently from the Janus fuzzer, it has
some similarities: it uses LKL in user space instead of some VM-based
approaches and it can fuzz file system implementations in a
two-dimensional manner (both mutating the FS image and the syscall
sequence to be invoked).

On the other hand, it much more tends to requiring as less manual
adjustment to new file systems as possible like in "Pulling JPEGs out
of thin air" experiment from the AFL author
(https://lcamtuf.blogspot.com/2014/11/pulling-jpegs-out-of-thin-air.html).

The harnesses currently included can test:
* file system implementation
* use one file system as a model for another (triggering crash when
behaviors differ)
* eBPF verifier
* HID via the /dev/uhid pseudo device

This is still a work-in-progress in the following sense: while the
code in this repository is based on a harness that has found a couple
tens of bugs, this particular code is a *refactored* version behaving
much nicer but "some known bugs removed, some unknown ones
introduced". Specifically, right now it needs some manual fixing of
compile errors of my patched LKL version (but someday it should run on
the vanilla LKL anyway).

Best regards
Anatoly