Syzbot and the Tale of Thousand Kernel Bugs
summary
Automated fuzzing plus sanitizers already uncovers thousands of kernel bugs: syzbot/syzkaller with grammar-based syzkaller and KASAN/KMSAN/KTSAN reports roughly 200 bugs/month, >1,000 upstream, ~1,200 in Android/ChromeOS and >3,000 total submitted. Most are use-after-free, out-of-bounds, uninitialized-memory and race bugs; many are remotely triggerable via USB/network. The system produces reproducers and backport tracking but needs more syscall descriptions, input harnesses for external devices, and help to triage, fix and backport the hundreds of open reports.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:58Civilization runs on Linux (1)
- 1:14Security is Critical
- 2:11Kernel has lots of bugs
- 2:45syzbot: continuous kernel fuzzing
- 3:25USB Stack State
- 5:57"Stable" releases
- 7:22Distros State
- 8:39Bug Forking
- 12:40Existing Defences Are Not Enough (2)
- 16:10KMSAN (Kernel Memory Sanitizer)
- 19:44Syscall Descriptions
- 20:30Programs
- 20:53syzbot: fuzzing automation
- 21:38More Coverage
- 22:51External Inputs
- 24:18Lots of bugs are unfixed
- 26:07KASAN: manual checks: SKB
- 27:57Other Tools
- 31:17Kernel Testing
- 32:46Testing MUST be part of dev process
related talks
16mMaking syzbot reports more developer-friendly
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
23mSoK: Automating Kernel Vulnerability Discovery and Exploit Generation
21msyzbot ci: continuous patch series fuzzing
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
06mQ&A
20mKSG: Augmenting Kernel Fuzzing with System Call Specification Generation
19mSYZOS: Practical KVM fuzzing