FUZE: Towards Facilitating Exploit Generation for Kernel UAF Vulnerabilities

on YouTube ↗21m

" summary

Presents FUZE, a framework that combines kernel fuzzing and symbolic execution to find and analyze Linux kernel system calls that enable exploitation of Use-After-Free (UAF) bugs. FUZE is implemented by extending a binary analysis framework and a kernel fuzzer on 64-bit Linux and is evaluated on 15 real-world kernel UAFs to generate, diversify, and assess practical exploits and mitigation bypasses.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 1:34Background (cont.)
3. 2:05Crafting an Exploit for Kernel Use-After-Free
4. 3:27Needs Intensive Manual Efforts
5. 3:46Needs Extensive Expertise in Kernel
6. 4:14Needs Security Expertise
7. 4:44Some Past Research Potentially Tackling the Challenges
8. 6:37A Real World Example (CVE-2017-15649)
9. 7:54No Primitive Needed for Exploitation
10. 9:35Roadmap
11. 10:01FUZE - Extracting Critical Info.
12. 10:51FUZE - Performing Kernel Fuzzing
13. 11:47FUZE - Performing Symbolic Execution
14. 12:55Useful primitive identification
15. 15:08Case Study (cont)
16. 16:23Discussion on Failure Cases
17. 17:24Conclusion
18. 18:50Questions
19. 20:50THE ADVANCED COMPUTING SYSTEMS ASSOCIATION

" related talks

• 20mKFuzzTest: Targeted Fuzzing of Internal Kernel FunctionsEthan Graham · Linux Plumbers Conference 2025
• 34m1-Click-Fuzz：Systematically Fuzzing the Windows Kernel Driver with Symbolic Execution.Sangjun Park, Yunjin Park, Jongseong Kim · CODE BLUE 2024
• 46mBypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKLEugene Rodionov, Xuan Xing · Linux Security Summit North America 2025
• 46mFor The Win: The Art Of The Windows Kernel FuzzingGuangming Liu · HITBSecConf 2019 Amsterdam
• 23mSoK: Automating Kernel Vulnerability Discovery and Exploit GenerationBernhard Tellenbach, Anil Kurmus, Andrea Mambretti, Alessandro Sorniotti, Vincent Lenders, Damian Pfammatter · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 01h 15mMake your programs more reliable with FuzzingMarshall Clow · ACCU Autumn 2019 Belfast
• 28mkAFL: Hardware-Assisted Feedback Fuzzing for OS KernelsSebastian Schinzel, Thorsten Holz, Cornelius Aschermann, Sergej Schumilo, Robert Gawlik · 26th USENIX Security Symposium (USENIX Security '17)
• 45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In AndroidAlexandru Blanda · Black Hat Europe 2015