PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary
summary
PeriScope implements an in-kernel probe that marks MMIO and DMA pages not-present and intercepts accesses via page-fault hooking, enabling on-the-fly inspection or mutation. PeriFuzz feeds fuzzed values per fault and aligns iterations to softirq execution. Prototype runs on recompiled Linux 4.4 for ARM, targets Qualcomm and Broadcom Wi‑Fi drivers on Pixel 2 and Galaxy S6, achieves ~7–24 inputs/sec, and uncovers 15 vulnerabilities (9 previously unknown, 8 CVEs), including buffer overflows, double-fetch races and a kernel pointer disclosure.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:28Remote Compromise of Peripheral Chips
- 19:02Prototype implementation
- 19:18Fuzzing Target: Wi-Fi Drivers
- 22:43Kernel Address Leak (CVE-2018-11947)
- 23:40Fuzzing Throughput
- 24:27Conclusion & Takeaways
related talks
42mCPU Fuzzing: Automatic Discovery of...
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
40m(P)FACE into the Apple core and exploit to root
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
38mIn-Depth Analyzing and Fuzzing for Qualcomm Hexagon Processor
29mVirtual Device Fuzzing Support in QEMU
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions