NDSS 2020 HYPER-CUBE: High-Dimensional Hypervisor Fuzzing
SESSION 1B-1 HYPER-CUBE: High-Dimensional Hypervisor Fuzzing
Applying modern fuzzers to novel targets is often a very lucrative venture. Hypervisors are part of a very critical code base: compromising them could allow an attacker to compromise the whole cloud infrastructure of any cloud provider. In this paper , we build a novel fuzzer that aims explicitly at testing modern hypervisors.
Our high throughput fuzzer design for long running interactive targets allows us to fuzz a large number of hypervisors, both open source, and proprietary. In contrast to one-dimensional fuzzers such as AFL, HYPER-CUBE can interact with any number of interfaces in any order.
Our evaluation shows that we can find more bugs (over 2x) and coverage (as much as 2x) than state of the art hypervisor fuzzers. Additionally, in most cases, we were able to do so using multiple orders of magnitude less time than comparable fuzzers. HYPER-CUBE was also able to rediscover a set of well-known vulnerabilities for hypervisors, such as VENOM, in less than five minutes. In total, HYPER-CUBE found 54 novel bugs, and so far we obtained 37 CVEs.
Our evaluation results demonstrates that next generation coverage-guided fuzzers should incorporate a higher-throughput design for long running targets such as hypervisors.
PAPER
https://www.ndss-symposium.org/wp-con...
SLIDES
AUTHORS
Sergej Schumilo (Ruhr-Universität Bochum)
Cornelius Aschermann (Ruhr-Universität Bochum)
Ali Abbasi (Ruhr-Universität Bochum)
Simon Wörner (Ruhr-Universität Bochum)
Thorsten Holz (Ruhr-Universität Bochum)
Network and Distributed System Security (NDSS) Symposium 2020, 23-26 February 2019, Catamaran Resort Hotel & Spa in San Diego, California.
https://www.ndss-symposium.org/ndss-p...
ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.
https://www.ndss-symposium.org/
#NDSS #NDSS20 #NDSS2020 #InternetSecurity