Fuzzing the Native NTFS Read-Write Driver (NTFS3) in the Linux Kernel
summary
Built a Janus-based image+syscall fuzzer (open-sourced as peppera) that mutates NTFS3 metadata and generates context-aware syscall sequences, upgrades Linux Kernel Library to 6.0 and integrates memory sanitizers to run fast linked-kernel executors, and implements an NTFS image parser that fixes OEM/sector/USN and fixup arrays so mutated images mount. Results: two crashes in 11 minutes, a triage workflow that yields reproductions, and 14 issues found including a missing MFT record-size check and a missing attribute-name-length check that are patchable. Tools: syzkaller/Trinity inspiration, Janus flow, LKL executor, KASAN integration.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:25Agenda
- 2:45Amber Group
- 3:58Motivation
- 6:01Background
- 6:53File System
- 10:25Janus
- 15:37Brief introduction to NTFS
- 16:39NTFS Send Checks
- 17:33NTFS Cluster
- 19:15FixUp Code
- 20:41Reading Schedule
- 21:07Image of Using
- 22:11System Code Generation
- 24:03System Converting
- 25:00Real Machine vs Virtual Machine
- 26:15What is LKL
- 27:45LKL Workflow
- 29:01Issues
- 31:49Backtrace
- 32:27Root Cause
- 33:45Check Record Size
- 35:31Investigation
- 37:06Summary
- 38:13Thank you
related talks
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
46mFor The Win: The Art Of The Windows Kernel Fuzzing
38mHow I started chasing speculative type confusion bugs in the kernel and ended up wi...
28mExtreme OS Kernel Testing
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.
49mDrill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit