SEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
summary
SEMSAN is a configurable sanitizer that instruments kernel events with eBPF-based probes and exposes high-level utilities as Sanitizer Primitives so fuzzers can detect noncrashing, system-level semantic bugs. The implementation integrates with coverage-guided fuzzers, reproduces 10 known CVEs, and discovers five new vulnerabilities (including Docker local privilege escalations, a 21‑year‑old ViewVC path traversal, and an RCE in Grafana). Macrobenchmarks show <1% overhead; microbenchmarks 3–20% under continuous triggering.
AI-written summary · about
chapters (7)
- 0:00Semantic bugs and SEMSAN
- 3:19System-level semantic bugs
- 5:25SEMSAN framework
- 7:52Case studies and vulnerabilities
- 10:42ViewVC path traversal
- 13:12Performance evaluation
- 14:57Conclusion
related talks
38mKernel Sanitizers Office Hours
08mWIP: QKSAN: Towards Multiple Sanitizers for In-vehicle COTS OS Kernels
21mFuZZan: Efficient Sanitizer Metadata Design for Fuzzing
24mWhy you should be using automated fuzzing to test for security issues in your code
14mSANRAZOR: Reducing Redundant Sanitizer Checks in C/C++ Programs
52mStructure aware fuzzing
25mHow fuzzing helps to find bugs
30mAPISan: Sanitizing API Usages through Semantic Cross-Checking