Yesterday Once MorE: Facilitating Linux Kernel Bug Reproduction via Reverse Fuzzing

The Linux kernel remains vulnerable to numerous bugs, with approximately 65% detected by Syzkaller lacking Proof-of-Concept (PoC), hampering risk mitigation efforts. These bugs, termed irreproducible kernel bugs, highlight the challenge of statefulness issue-related irreproducibility in kernel fuzzing, which is an open research without definitive solutions. Our investigation reveals that suboptimal seed quality distribution in fuzzing is the root obstacle preventing effective tracking of the states leading to crashes. Inspired by this insight, we introduce Reverse Fuzzing ( $\text{RF}$ ), an innovative approach that infers hard-to-reach states by continuously reverse-oriented deriving from subsequently encountered bridge states to increase reproduction probability. $\text{RF}$ differentiates between the “trigger” seed, which directly causes crashes, and “activator” seeds, which establish the necessary preconditions, prioritizing exploration around trigger while simultaneously regenerating and maintaining activators during fuzzing, which effectively facilitate restructuring such elusive states from “yesterday”. We implement $\text{YOME}$ , a prototype leveraging $\text{RF}$ to strike a balance between fuzzing efficiency and effectiveness through customized scheduling and mutation strategies, armed with a refinement mechanism to improve seed quality distribution. Our evaluations validate that $\text{YOME}$ reproduces 110% more bugs than previous kernel fuzzers and demonstrate its practicality in real-world scenarios. $\text{YOME}$ generated 125 PoCs (30.1% of the total) and uncovered 23 unique bugs, with 40 confirmed and 5 assigned CVEs.