DR. CHECKER: A Soundy Analysis for Linux Kernel Drivers
summary
DR. CHECKER is a modular, static bug-finder that implements soundy (mostly sound) analysis by combining pointer and taint engines; both are flow-sensitive, context-sensitive, field-sensitive and share global state. It scopes analysis to third‑party drivers, skips core kernel internals, and uses loop/traversal optimizations to stay practical. Running on 3.1M LOC across nine kernels finds 158 previously unknown zero‑day bugs with 78% precision; the tool is open‑sourced.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:55First, a story...
- 1:50Why Drivers?
- 2:57Motivation
- 4:25Program Analysis on Kernel Code
- 5:05Precision vs. Soundness
- 6:05Soundiness
- 6:42Dr. Checker: Assumptions
- 8:09Dr. Checker: Design
- 10:21Soundy Driver Traversal
- 14:09Identifying Vendor Drivers
- 14:42Driver Entry Points
- 15:53Evaluation: Mobile Kernels
- 17:20Other Tools: Analysis
- 17:53Other Tools: Warnings
- 20:53Zero-day Bug
- 21:59Results: Soundy vs. Sound
- 23:32Conclusion
- 24:14Help Make Drivers Great Again
related talks
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
53mNumchecker: A System Approach for Kernel Rootkit Detection
06mQ&A
15mEffective Static Analysis of Concurrency Use-After-Free Bugs in Linux Device Drivers
39mSyzDescribe: Principled, Automated, Static Generation of Syscall Descriptions for Kernel Drivers
45mD1T1 - How to Analyze and Find Bugs in MacOS and iOS Kernel Drivers
52mWelcome & Opening Remarks & Meaningful Bounds Checking in the Linux Kernel
56mWindows Kernel Graphics Driver Attack Surface