Journal
2019 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP 2019)
Volume -, Issue -, Pages 818-834Publisher
IEEE COMPUTER SOC
DOI: 10.1109/SP.2019.00035
Keywords
-
Funding
- NSF [CNS-1563848, CNS-1704701, CRI-1629851, CNS-1749711]
- ONR [N000141512162]
- DARPA TC (DARPA) [FA8650-15-C-7556]
- ETRI IITP/KEIT [B0101-17-0644]
- U.S. Department of Defense (DOD) [N000141512162] Funding Source: U.S. Department of Defense (DOD)
- Institute for Information & Communication Technology Planning & Evaluation (IITP), Republic of Korea [2014-3-00035-006] Funding Source: Korea Institute of Science & Technology Information (KISTI), National Science & Technology Information Service (NTIS)
Ask authors/readers for more resources
File systems, a basic building block of an OS, are too big and too complex to be bug free. Nevertheless, file systems rely on regular stress-testing tools and formal checkers to find bugs, which are limited due to the ever-increasing complexity of both file systems and OSes. Thus, fuzzing, proven to be an effective and a practical approach, becomes a preferable choice, as it does not need much knowledge about a target. However, three main challenges exist in fuzzing file systems: mutating a large image blob that degrades overall performance, generating image-dependent file operations, and reproducing found bugs, which is difficult for existing OS fuzzers. Hence, we present JANUS, the first feedback-driven fuzzer that explores the two-dimensional input space of a file system, i.e., mutating metadata on a large image, while emitting image-directed file operations. In addition, JANUS relies on a library OS rather than on traditional VMs for fuzzing, which enables JANUS to load a fresh copy of the OS, thereby leading to better reproducibility of bugs. We evaluate JANUS on eight file systems and found 90 bugs in the upstream Linux kernel, 62 of which have been acknowledged. Forty-three bugs have been fixed with 32 CVEs assigned. In addition, JANUS achieves higher code coverage on all the file systems after fuzzing 12 hours, when compared with the state-of-the-art fuzzer Syzkaller for fuzzing file systems. JANUS visits 4.19x and 2.01x more code paths in Btrfs and ext4, respectively. Moreover, JANUS is able to reproduce 88-100% of the crashes, while Syzkaller fails on all of them.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available