SYZOS: Practical KVM fuzzing
summary
SYZOS loads an immutable C library into the guest and fuzzes sequences of API calls instead of raw instruction blobs, exposing primitives for MSR access, interrupts, VM lifecycle and nested virtualization control; host-side work uses pseudo-syscalls and a decoupled VM vs vCPU setup so a single VM can run multiple vCPUs for races. Prototype finds 9 KVM bugs, shows an immediate 5% ARM64 coverage jump and nearly 2× KVM coverage on x86, and runs ~100 iterations/sec.
AI-written summary · about
chapters (10)
- 0:00Introduction to SYZOS
- 1:45Reducing KVM search space
- 3:10Architectural changes in KVM
- 3:51Introducing COS for guest fuzzing
- 5:39Execution model with COS
- 7:04Real execution trace demo
- 10:18Benefits of COS approach
- 10:40Validation of COS effectiveness
- 12:37Future roadmap for SYZOS
- 15:20Q&A session
related talks
24mQSYM : A Practical Concolic Execution Engine Tailored for Hybrid Fuzzing
37mSyzbot: 7 years of continuous kernel fuzzing
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
50mWhat the Fuzz
20mKSG: Augmenting Kernel Fuzzing with System Call Specification Generation
43mSyzbot and the Tale of Thousand Kernel Bugs
46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL
42mCPU Fuzzing: Automatic Discovery of...