Fuzzing Host-to Guest Attack Surface in Android Protected KVM
summary
Android pKVM’s host-to-guest attack surface receives an LKL-based fuzzing harness that feeds mutated virtio PCI/MMIO inputs into front-end drivers; fuzzers run 24/7, catch coverage via libFuzzer, and exercise virtio-ring parsing. Concrete findings include an out-of-bounds stack write in virtio-block triggered by an unusual block size and an exploitable misuse of the descriptor next field that leads to controlled CPI arguments. Fixes get upstreamed to u-boot and kernel; limitations include no SMP in LKL and x86-specific behavior versus arm64.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:59Android Protected KVM
- 1:58Security Concepts
- 3:49Attack Surface
- 8:15Existing efforts
- 9:10Why fuzz
- 9:51Challenges
- 11:05LKL
- 12:12Overview
- 13:24Use Case
- 15:02Code
- 16:22Example
- 16:52Root Cause
- 17:47Patches
- 18:35Issues
- 19:20Conclusion
- 20:38Future work
- 21:15Questions
related talks
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
27m3d Red Pill: A Guest-to-Host Escape on QEMU/KVM Virtio Device
29mVirtual Device Fuzzing Support in QEMU
35mScavenger: Misuse Error Handling Leading to Qemu/KVM Escape
19mSYZOS: Practical KVM fuzzing
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android