SeqFuzz: Efficient Kernel Directed Fuzzing via Effective Component Inference
摘要
Directed greybox fuzzing (DGF) is an efficient method for testing specific target sites in programs, making it particularly promising for large-scale software like OS kernels. However, the existing DGF approaches rely heavily on distance metrics to evaluate the quality of seeds, which suffer from critical limitations. While these metrics measure the proximity of the target sites, they fail to analyze the seed’s internal structure or infer its effective components, the key to guiding directed fuzzing. To overcome these limitations, we propose SeqFuzz, a novel DGF for kernels that dynamically infers the effective components of seeds and optimizes the seed scheduling. Specifically, SeqFuzz models the syscall sequences in seeds and calculates the sequence distances to infer the effective sequences (i.e., the effective components) during the fuzzing process. Then, based on the inference results, SeqFuzz conducts a fine-grained evaluation of the seeds to guide the seed scheduling further. We evaluate the performance of SeqFuzz and compare it with the state-of-the-art kernel fuzzers. The experimental results demonstrate the significant improvements of SeqFuzz. SeqFuzz reproduces 450% more bugs than Syzkaller and outperforms SyzDirect with an average 7.8 \(\times \) speedup (up to 61.3 \(\times \) ). We will open-source SeqFuzz to facilitate the kernel security research.