基于种子智能生成的内核模糊测试模型

Kernel Fuzzing Model Base on Intelligent Seed Generation

操作系统具有庞大的用户群体,因此使得内核漏洞具有极强的通用性。模糊测试作为一种高效的漏洞挖掘方法,也被应用于操作系统内核,并且已经取得不错的成果。但是,目前流行的面向内核的模糊测试模型Syzkaller在生成种子时具有一定的盲目性,无法自动产生具有依赖关系的系统调用,制约了模糊测试的代码覆盖能力。为解决上述问题,本文提出并实现了基于种子智能生成的内核模糊测试模型SyzMix。该模型一方面结合LSTM(Long Short-Term Memory)神经网络,使用语法模板,通过序列化操作和反序列化操作,能自动生成更多蕴含潜在依赖关系的系统调用序列,有效提高了种子执行的成功率;另一方面,通过静态分析方法获得系统调用显式依赖关系,通过动态分析方法获得系统调用隐式依赖关系,并通过上述依赖关系进一步优化种子内部系统调用关系,结合测试用例的生成策略和变异策略,显著提高了选择系统调用的准确性。综合上述方法,SyzMix达到了更高的代码覆盖能力和代码覆盖加速比。为了验证模型的有效性和实用性,利用SyzMix与Syzkaller在不同版本的内核中进行测试,种子执行成功率提高了16%,选择系统调用的准确性提高了88.8%,内核代码覆盖率提高了7.87%,代码覆盖加速比达到了132.3%。另外,SyzMix在不同版本的内核中发现了8个的未知bug,并申请得到CVE编号CVE-2021-45868。

Operating system has a large user base,which makes the kernel vulnerability very versatile.As an efficient vulnerability mining method,fuzzing has also been applied to the operating system kernel,and has achieved good results.However,Syzkaller,the popular kernel oriented fuzzing model,has some blindness in generating seeds,and cannot automatically generate system calls with dependencies,which will restrict the code coverage ability of fuzzing.To solve these problems,this paper proposes and implements a kernel fuzzing model SyzMix based on seed intelligent generation.On the one hand,the model combines with LSTM(long short term memory)neural network,uses syntax template,automatically generates more system call sequences with potential dependencies through serialization and deserialization,and effectively improves the success rate of seed execution;on the other hand,the explicit dependencies of system calls are obtained by static analysis method,and the implicit dependencies of system calls are obtained by dynamic analysis method,and further optimize the relationship of system calls within the seed through the above dependencies.Combined with the generation strategy and mutation strategy of test cases,the accuracy of selecting system calls is significantly improved.Based on the above methods,SyzMix achieves higher code coverage and the code coverage speed-up.To verify the validity and practicability of the model,SyzMix and Syzkaller are tested in different versions of the kernel.The success rate of seed execution is increased by 16%,the accuracy of selecting system calls is improved by 88.8%,the kernel code coverage is increased by 7.87%,and code coverage achieved a speed-up of 132.3%.In addition,SyzMix found eight unknown bugs in different versions of the kernel and requested CVE number CVE-2021-45868.