Critical-object guided operating system fuzzing

1 . A computer-implemented critical-object guided operating system fuzzing method for guiding an operating system fuzzer to find security-related bugs in a kernel space of the operating system, the method comprising:

identifying critical/sensitive objects;

determining binary code addresses that result in access to the critical/sensitive objects; and

executing the operating system fuzzer based on the binary code addresses.

2 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , wherein the identifying the critical/sensitive objects includes using a static analysis to obtain a call graph from kernel entry points.

3 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , wherein the identifying the critical/sensitive objects includes using a call graph to identify accessible memory objects and their respective access-types.

4 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , wherein the identifying the critical/sensitive objects includes generating a list of the critical/sensitive objects from identified accessible memory objects that create a security vulnerability if corrupted.

5 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 ,

wherein the identifying the critical/sensitive objects includes:

using a call graph to identify all accessible memory objects and their respective access-types; and

generating a list of the critical/sensitive objects from identified accessible memory objects that create a security vulnerability if corrupted.

6 . The computer-implemented critical-object guided operating system fuzzing method of claim 5 , further comprising mutating inputs to the operating system fuzzer to include code that results in access to the critical/sensitive objects.

7 . The computer-implemented critical-object guided operating system fuzzing method of claim 6 , wherein the operating system fuzzer detects when an executed basic block contains code to access the binary code address of the critical/sensitive objects.

8 . The computer-implemented critical-object guided operating system fuzzing method of claim 5 , wherein the operating system fuzzer detects when an executed basic block contains code to access the binary code address of the critical/sensitive objects.

9 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , wherein a binary code address of the binary code addresses is determined using source code and binary debug information.

10 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , further comprising mutating inputs to the operating system fuzzer to include code that results in access to the critical/sensitive objects.

11 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , wherein the operating system fuzzer detects when an executed basic block contains code to access the binary code address of the critical/sensitive objects.

12 . The computer-implemented critical-object guided operating system fuzzing method of claim 1 , embodied in a cloud-computing environment.

13 . A critical-object guided operating system fuzzing computer program product for guiding an operating system fuzzer to find security-related bugs in a kernel space of the operating system, the critical-object guided operating system fuzzing computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform:

identifying critical/sensitive objects;

determining binary code addresses that result in access to the critical/sensitive objects; and

executing the operating system fuzzer based on the binary code addresses.

14 . The critical-object guided operating system fuzzing computer program product of claim 13 , wherein the identifying the critical/sensitive objects includes using a static analysis to obtain a call graph from kernel entry points.

15 . The critical-object guided operating system fuzzing computer program product of claim 13 , wherein the identifying the critical/sensitive objects includes using a call graph to identify accessible memory objects and their respective access-types.

16 . The critical-object guided operating system fuzzing computer program product of claim 13 , wherein the identifying the critical/sensitive objects includes generating a list of the critical/sensitive objects from identified accessible memory objects that create a security vulnerability if corrupted.

17 . The critical-object guided operating system fuzzing system of claim 16 , embodied in a cloud-computing environment.

18 . The critical-object guided operating system fuzzing computer program product of claim 13 , wherein the identifying the critical/sensitive objects includes:

using a call graph to identify all accessible memory objects and their respective access types; and

generating a list of the critical/sensitive objects from identified accessible memory objects that create a security vulnerability if corrupted.

19 . The critical-object guided operating system fuzzing computer program product of claim 13 , further comprising mutating inputs to the operating system fuzzer to include code that results in access to the critical/sensitive objects.

20 . A critical-object guided operating system fuzzing system for guiding an operating system fuzzer to find security-related bugs in a kernel space of the operating system, said critical-object guided operating system fuzzing system comprising:

a processor; and

a memory, the memory storing instructions to cause the processor to perform:

identifying critical/sensitive objects;

determining binary code addresses that result in access to the critical/sensitive objects; and

executing the operating system fuzzer based on the binary code addresses.