Internships/ProjectIdeas/SnapshotFuzzingDevice
Implement a snapshot fuzzing device
Summary: Add a new emulated device for rapid guest-initiated snapshot/restore functionality for fuzzing.
Fuzz testing runs a program with random inputs to find bugs that lead to crashes or other program failures. Fuzz testing is a popular technique for finding security bugs.
Many recent fuzzing projects rely on snapshot/restore functionality [1,2,3,4,5]. For example tests/fuzzers that target large targets, such as OS kernels and browsers benefit from full-VM snapshots, where solutions such as manual state-cleanup and fork-servers are insufficient. Many of the existing solutions are based on QEMU, however there is currently no upstream-solution. Furthermore, hypervisors, such as Xen have already incorporated support for snapshot-fuzzing. In this project, you will implement a virtual-device for snapshot fuzzing, following a spec agreed-upon by the community. The device will implement standard fuzzing APIs that allow fuzzing using engines, such as libFuzzer and AFL++. The simple APIs exposed by the device will allow fuzzer developers to build custom harnesses in the VM to request snapshots, memory/device/register restores, request new inputs, and report coverage.
Project goals include:
- Adding a new emulated device for snapshot fuzzing into QEMU.
- Writing documentation and final editing of the hardware interface specification so fuzzer developers can learn how to take advantage of the device from inside a guest.
Links:
- https://arxiv.org/pdf/2111.03013.pdf
- https://blog.mozilla.org/attack-and-defense/2021/01/27/effectively-fuzzing-the-ipc-layer-in-firefox/
- https://www.usenix.org/system/files/sec20-song.pdf
- https://github.com/intel/kernel-fuzzer-for-xen-project
- https://github.com/quarkslab/rewind
Details:
- Skill level: Intermediate with interest and experience in fuzzing.
- Language/Skills: C
- Topic/Skill Areas: Fuzzing, OS/Systems/Drivers
- Mentor: Alexander Bulekov <alxndr@bu.edu> (a1xndr on IRC)