SyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers
summary
A static analysis tool called SyzDescribe automatically generates Syzkaller‑compatible syscall descriptions for Linux kernel device drivers by modeling driver initialization and recovering handlers, command values, argument types and non-open file descriptor dependency relationships. It evaluates on hundreds of drivers, outperforms DIFUZE and KSG in accuracy, coverage and crashes, reports 78 bugs in Syzkaller descriptions that are merged upstream, and recovers 154 syscall handlers on Pixel 6 while finding 18 crashes.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:06Need for automated syscall descriptions
- 4:18SyzDescribe goals and insights
- 5:41Linux device driver basics
- 9:45SyzDescribe design and analysis
- 12:42Recovering command values and types
- 15:16Evaluation results
- 18:53Diffuse static analysis comparison
- 21:24KSG dynamic analysis comparison
- 25:22Manual SyzKaller comparison
- 27:33Gap with ground truth
- 30:02Android kernel evaluation
- 31:29Future work and takeaways
- 32:35Q&A
related talks
20mKSG: Augmenting Kernel Fuzzing with System Call Specification Generation
43mSyzbot and the Tale of Thousand Kernel Bugs
19mSYZOS: Practical KVM fuzzing
37mSyzbot: 7 years of continuous kernel fuzzing
53mHow to make syzbot reports easier to debug?
31mEnhancing Kernel Functional Safety Analysis with KS-nav
31mDR. CHECKER: A Soundy Analysis for Linux Kernel Drivers
18mOptimizing Input Minimization in Kernel Fuzzing