WIP: QKSAN: Towards Multiple Sanitizers for In-vehicle COTS OS Kernels
summary
QKSAN builds a hypervisor-level sanitizer for binary-only in-vehicle kernels by instrumenting kernels in QEMU TCG and maintaining a 10-bit compound shadow (10 bits per 8 bytes) to track allocated/initialized/frozen/red-zone states. Implementation is ~5,000 LOC with a JSON config and syscall templates to integrate with modified syzkaller for coverage. Evaluation reproduces real Linux CVEs, finds seven known Linux bugs during fuzzing, and detects 18 crashes from 18 POCs on QNX (unconfirmed as vulnerabilities).
AI-written summary · about
related talks
38mKernel Sanitizers Office Hours
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
59mSanitizing the Linux Kernel — On KASAN and other Dynamic Bug-finding Tools
43mSyzbot and the Tale of Thousand Kernel Bugs
35mValidating Freedom From Interference in Automotive Linux
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
50mAddressSanitizer/ThreadSanitizer for Linux Kernel
01h 00mSanitize for your Sanity: Sanitizers tools for Modern C++