SoK: Automating Kernel Vulnerability Discovery and Exploit Generation
summary
Systematization analyzes 41 papers from 2013–2023 and finds 22 works on vulnerability discovery (14 static, 8 fuzzers), nine on later exploit stages, and ten new kernel techniques; tooling centers on S2E, KLEE-like symbolic engines and fuzzers but portability breaks across kernel versions. The taxonomy splits bugs into precursor/helper/base roles and validates it with a Google Project Zero race-to-use-after-free example. Only two papers try exhaustive path-based exploitability assessment; no end-to-end automated kernel exploit generator works reliably at scale.
AI-written summary · about
chapters (7)
- 0:00Automated kernel exploit generation
- 1:38Evolution of attack techniques
- 4:07Focus on kernel vulnerabilities
- 6:11Kernel vulnerability taxonomy
- 11:55Exploitation steps
- 14:45Open problems in research
- 21:48Conclusions and future
related talks
28mEnhancing Kernel Bug Discovery with Large Language Models
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
43mSyzbot and the Tale of Thousand Kernel Bugs
39mSoftware Security Engineering (Learnings from the past to fix ...)
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
51m10 Years of Linux Security - A Report Card
21mFUZE: Towards Facilitating Exploit Generation for Kernel UAF Vulnerabilities
13mThe Automation of Exploits: Will Eatherton on AI-Driven Security and the End of Obscurity