Fuzzing Linux Drivers
Posted : adminOn 1/24/2018Pub Mania Games Free Download. I’ve been thinking about what would be the best way to fuzz-test a Linux kernel module, for example a filesystem. Of course this can be done in the context of a live kernel, but for a variety of reasons I’d prefer to run the LKM in user space. At the source level, the interface to an LKM seems a little hairy, but at the object level they are really simple. So, a reasonable approach would seem to be to write a user-space loader for compiled LKMs and then just call the object code directly. At that point it would become necessary to write a set of shims to support each class of device driver and then fuzzing could start.
Anyway, I’m curious to see what people think about this idea before I go off and hack. I did some random web searching and didn’t turn up an existing implementation of this idea, though of course there are plenty of resources on testing various parts of Linux. I’ve never thought of the kernel’s object ABI (symbols exported to modules) as really simple. The interface is big and changes often, though the changes wouldn’t affect you if you only need to target one version of a driver. I think I’d start with User-Mode Linux. It should take care of the ABI while giving you the flexibility of user space. In particular, the ability to fork, try some fuzz, then just exit and go back to the fork when something fails is pretty appealing.
Earlier this year, security researchers from the University of London presented POTUS, a tool that finds vulnerabilities in Linux USB device drivers. The tool finds bugs by setting up a virtual machine, a generic USB device, and by testing a USB driver using techniques such as fault injection, concurrency fuzzing, and symbolic execution. The Nightly Show 02 24. High performance fuzzing of USB drivers using. The USB fuzzing technique either. Further class specific ids may be found in the USB database on linux-usb.