HYPER-CUBE: High-Dimensional Hypervisor Fuzzing

Abstract

Virtual machine monitors (VMMs, also called hypervisors) represent a very critical part of a modern software stack: compromising them could allow an attacker to take full control of the whole cloud infrastructure of any cloud provider. Hence their security is critical for many applications, especially in the context of Infrastructure-as-a-Service. In this paper, we present the design and implementation of HYPER-CUBE, a novel fuzzer that aims explicitly at testing hypervisors in an efficient, effective, and precise way. Our approach is based on a custom operating system that implements a custom bytecode interpreter. This high-throughput design for long-running, interactive targets allows us to fuzz a large number of both open source and proprietary hypervisors. In contrast to one-dimensional fuzzers such as AFL, HYPER-CUBE can interact with any number of interfaces in any order. Our evaluation results show that we can find more bugs (over 2×) and coverage (as much as 2×) than state-of-the-art hypervisor fuzzers. In most cases, we were even able to do so using multiple orders of magnitude less time than comparable fuzzers. HYPER-CUBE was also able to rediscover a set of well-known hypervisor vulnerabilities, such as VENOM, in less than five minutes. In total, we found 54 novel bugs, and so far obtained 43 CVEs. Our evaluation results demonstrate that nextgeneration coverage-guided fuzzers should incorporate a higherthroughput design for long-running targets such as hypervisors.

Fuzzing: A Survey for Roadmap

“…A higher execution speed means that fuzzing can examine more test cases, which ofers a higher opportunity to ind defects. Therefore, researchers put many eforts to improve the execution speed of fuzzing, including binary analysis [58,134], optimized execution processes [46,133,204,216], and application-speciied techniques [91,162,163,174,195,196,211].…”

“…FIRM-AFL [211] mitigates the overhead via combining user-mode emulation and full-system emulation, and it mainly runs programs in the user-mode emulation. In order to fuzz VMMs (i.e., hypervisors), Schumilo et al [162,163] design a customized OS and a fast snapshot restoration mechanism to conduct fuzzing eiciently. As to the ile systems, mutating a whole disk image degrades the fuzzing throughput signiicantly because an image is too large.…”

HyperDbg: Reinventing Hardware-Assisted Debugging

“…Recently, researchers employ newer hardware-based features (e.g. Intel-PT) for low-level hypervisor fuzzing [79,80], kernel failure reverse debugging [36] as well as machine learning approaches [5], to discover vulnerabilities and bugs. Similar ideas are deployed for embedded systems arming application tracing [26], debugging [67,70], unpacking [94] on Arm processors.…”

Nyx-Net: Network Fuzzing with Incremental Snapshots

“…Fuzzers such as syzkaller or kAFL [25,43,53,55,58,63] adapted AFL's fuzzing model to kernel fuzzing. Fuzzers like VDF and Nyx even target hypervisors [24,51,52]. Hypervisor-based fuzzing is also commonly used to fuzz firmware [12,35,50,69] Snapshots were also used previously to speed up fuzzing.…”