Don't Trust Your USB! How to Find Bugs in USB Device Drivers
summary
A virtual USB fuzzer called vUSBf framework uses QEMU/KVM, the QEMU USB redirection protocol and Python device emulators to simulate millions of USB device interactions at scale. It runs up to 150 tests/second per 24‑core host, supports clustering, assigns unique XML test IDs for reproducibility, and finds real kernel crashes: a 550k‑test run reports ~4,000 bugs including 92 kernel panics and reproductions validated on facedancer hardware.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:27Why USB
- 1:44History of USB
- 3:17Impact of USB
- 4:12Black Hat Las Vegas
- 6:47Linux
- 7:38Virtualisation
- 9:11Architecture
- 9:34Fuzzing
- 11:42Export Sequences
- 12:03Are we faster
- 12:40Faster fuzzing
- 13:04Demo
- 16:02Archive
- 23:15Results
- 23:54Outro
related talks
29mVirtual Device Fuzzing Support in QEMU
27mCracking With Automated USB Fuzz
18mμUSB: Practical and Safe USB Driver Reuse for Arm TrustZone
36mUSB Arsenal for Masses
52mDebugging Usually Slightly Broken (USB) Devices and Drivers
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
08mHubBub: Contention-Based Side-Channel Attacks on USB Hubs
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions