DIFUZE: Android Kernel Driver Fuzzing
summary
Difuze compiles kernel sources to LLVM bitcode, extracts ioctl handlers and device names, recovers command IDs and C struct layouts, then generates concrete struct instances and ships fuzz units to an on‑device executor over ADB. Tested on seven phones (789 handlers, 469 device names recovered) it finds 36 unique crashes (3565 command IDs recovered; ~53% expect input pointers) including a MediaTek out‑of‑bounds that yields kernel escalation, writable NVRAM that changes serial/IMEI, and a buggy kernel‑assert path writing to 0xdead. Tool accuracy in a 35‑handler sample is ~90%.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:21Linux kernel fundamentals
- 3:56Device drivers and ioctl
- 7:33Security risks in Android
- 9:45Challenges with ioctl fuzzing
- 12:42Introducing Defuse
- 15:32Interface recovery pipeline
- 25:07Structure generation
- 28:54Execution and triage
- 32:12Evaluation and results
- 37:27Example vulnerabilities
- 40:31Future work and conclusion
- 42:22Q&A session
related talks
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android
20mD2T2 - A New Fuzzing Method for Android
54mMy Fuzzy Driver
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
22mCharm: Facilitating Dynamic Analysis of Device Drivers of Mobile Systems
42mAndroid: Protecting the Kernel