Virtual Device Fuzzing Support in QEMU
summary
Built a generic fuzzer that plugs into QEMU’s existing qtest and libqos test APIs to generate port‑IO, MMIO and DMA inputs, minimize crashes into compact qtest reproducers, and run continuously via OSS-Fuzz. Implementation uses llvm/libFuzzer-style instrumentation, automatic PCI setup and DMA buffer generation. Results so far: over 50 bugs reported, six assigned IDs, reproducers small enough for email, and ongoing work to expand to migration, spice/VNC backends and vhost paths.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:58QEMU and Virtual Devices
- 3:29Code Analysis
- 6:37Fuzzing in QEMU - an outline
- 8:21Missing pieces • QEMU integration
- 11:42Fuzzing framework • American Fuzzy Lop
- 15:24State rewinds
- 17:19Recap: Testing Devices in QEMU
- 19:36Fuzzing a Device Writing a new QTest test
- 22:05Generic Device Fuzzer
related talks
50mWhat the Fuzz
25mDon't Trust Your USB! How to Find Bugs in USB Device Drivers
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
28mkAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
39mEL3XIR: Fuzzing COTS Secure Monitors
32mFuzzing Zephyr Apps - Struggles of Dynamic Analysis on Embedded Applications