kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
summary
Combines Intel Processor Trace with a KVM-aware hypervisor and on‑the‑fly PT decoding in QEMU to drive AFL-style coverage feedback for kernel targets on Linux, macOS and Windows. Uses supervisor-mode filtering and IP-range filters to record only kernel branches, swaps VM snapshots to remain crash-tolerant, and injects a hypercall panic handler to avoid long timeouts. Delivers near-native speed — up to 17,000 executions per second on a laptop — and finds real flaws, reporting over 1,000 crashing inputs including bugs in ext4, HFS/APFS and NTFS.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:27Motivation
- 5:20Blackbox Fuzzing
- 7:03Feedback Mechanism
- 11:10Intel Processor Trace
- 13:27Trace Filtering
- 15:48Inter-VM Communication
- 18:10Implementation
- 21:09Evaluation Driver
- 22:45Conclusion
related talks
50mWhat the Fuzz
58mFuzzing Embedded (Trusted) Operating Systems Using AFL
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
54mMy Fuzzy Driver
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications
45mFuzzing with AFL
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
20mAFL++ : Combining Incremental Steps of Fuzzing Research