Awesome

Table of Contents

• 1. Linux Kernel Enriched Corpus for Fuzzers
  • 1.1. Using Enriched corpus with Syzkaller
  • 1.2. Using Enriched corpus with HEALER
  • 1.3. Citing
  • 1.4. DIY
    • 1.4.1. Fetching Corpus Manually
    • 1.4.2. Generating corpus.db File
  • 1.5. Corpus Files Available
  • 1.6. Results
    • 1.6.1. Coverage over time
    • 1.6.2. Unique Crashes over time
    • 1.6.3. Total Crashes over time
    • 1.6.4. CVEs:
    • 1.6.5. New Bugs Reported:
    • 1.6.6. More bugs discovered (includes bugs that were found sooner than syzbot & bugs undiscovered by syzbot)

1. Linux Kernel Enriched Corpus for Fuzzers

Documentation for using and generating the Enriched corpus provided here.

For more questions, feel free to email Palash Oswal or Rohan Padhye.

1.1. Using Enriched corpus with Syzkaller

The latest copy of the Corpus file corpus.db is available in the releases for this repository. The file is updated daily.

Download it to syzkaller workdir and start syzkaller.

mkdir workdir
cd workdir
wget https://github.com/cmu-pasta/linux-kernel-enriched-corpus/releases/download/latest/corpus.db

1.2. Using Enriched corpus with HEALER

The corpus programs are stored in files directory and can directly be imported to HEALER.

Clone the repository and copy over files/* to output/corpus/ directory in HEALER. From within HEALER working directory, run the following commands.

mkdir -p output/corpus
cp -vr <path/to/files/> output/corpus/

1.3. Citing

Please use the following BibTeX to cite enriched corpus.

@phdthesis{
author={Oswal,Palash B.},
year={2023},
title={Improving Linux Kernel Fuzzing},
journal={ProQuest Dissertations and Theses},
pages={43},
isbn={9798379515645},
language={English},
url={https://www.proquest.com/dissertations-theses/improving-linux-kernel-fuzzing/docview/2812311865/se-2},
} 

1.4. DIY

1.4.1. Fetching Corpus Manually

collect.py : currently fetches syz reproducers from all fixed Linux Kernel upstream crashes in syzbot.

This script can be modified to fetch corpus programs from other kernel versions and to fetch "C" Programs instead of syz reproducers.

1.4.2. Generating corpus.db File

If you have a collection of syz programs that need to be converted to a syzkaller comptaible corpus.db file, you can use syz-db.go pack from syzkaller.

An implementation of this is available in the GitHub actions workflow here.

1.5. Corpus Files Available

1. corpus.db : Enriched Corpus (version 0 for syz-db)
2. ci-qemu-upstream-corpus.db : Corpus Obtained from Syz-CI (Google's syzbot) (version latest per syz-db)
3. enriched-ci-qemu-upstream-corpus.db : Enriched Version of the Corpus Obtained from Syzbot (version 0 for syz-db) A detailed comparison of the three is provided in the research document. More documentation to follow.

1.6. Results

Experiments performed by fuzzing 1 instance using 2VCPUs and 4GB RAM for 24 hours. Corpus comparison experiments performed with 8 such VMs.

System Used : ThinkMate, Intel® Xeon® Gold 6226R.

Kernel Versions Tested: Linux v6.0.8 and v6.1.20

1.6.1. Coverage over time

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

1.6.2. Unique Crashes over time

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

1.6.3. Total Crashes over time

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

1.6.4. CVEs:

• CVE-2023-26544
• CVE-2023-26605
• CVE-2023-26606
• CVE-2023-26607

1.6.5. New Bugs Reported:

• https://lkml.org/lkml/2023/2/20/128
• https://lkml.org/lkml/2023/2/20/773
• https://lkml.org/lkml/2023/2/20/785
• https://lkml.org/lkml/2023/2/20/860
• https://lkml.org/lkml/2023/2/21/1353
• https://lkml.org/lkml/2023/2/22/3
• https://lkml.org/lkml/2023/4/13/39
• https://lkml.org/lkml/2023/4/13/45
• https://lkml.org/lkml/2023/4/13/1317
• https://lkml.org/lkml/2023/4/13/1350
• https://lkml.org/lkml/2023/6/3/90
• https://lkml.org/lkml/2023/6/3/91
• https://lkml.org/lkml/2023/6/3/95
• https://lkml.org/lkml/2023/6/3/98
• https://lkml.org/lkml/2023/6/3/146
• https://lkml.org/lkml/2023/6/3/148 and many more

1.6.6. More bugs discovered (includes bugs that were found sooner than syzbot & bugs undiscovered by syzbot)