SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel
This addresses a critical gap in continuous fuzzing for the Linux kernel, helping prioritize bug fixes to improve security, though it is incremental as it builds on existing fuzzing methods.
The paper tackles the problem of fuzzing platforms neglecting to evaluate the security impact of discovered bugs, which can lead to delayed fixes. SyzScope automatically uncovers high-risk impacts from seemingly low-risk bugs, identifying that over 15% of analyzed bugs (183 out of over 1,000) actually have severe impacts like control flow hijack.
Fuzzing has become one of the most effective bug finding approach for software. In recent years, 24*7 continuous fuzzing platforms have emerged to test critical pieces of software, e.g., Linux kernel. Though capable of discovering many bugs and providing reproducers (e.g., proof-of-concepts), a major problem is that they neglect a critical function that should have been built-in, i.e., evaluation of a bug's security impact. It is well-known that the lack of understanding of security impact can lead to delayed bug fixes as well as patch propagation. In this paper, we develop SyzScope, a system that can automatically uncover new "high-risk" impacts given a bug with seemingly "low-risk" impacts. From analyzing over a thousand low-risk bugs on syzbot, SyzScope successfully determined that 183 low-risk bugs (more than 15%) in fact contain high-risk impacts, e.g., control flow hijack and arbitrary memory write, some of which still do not have patches available yet.