SUNFLOWER: Enhancing Linux Kernel Fuzzing via Exploit-Driven Seed Generation

The Linux kernel is the foundation of billions of contemporary computing systems, and ensuring its security and integrity is a necessity. Despite the Linux kernel's pivotal role, guaranteeing its security is a difficult task due to its complex code logic. This leads to new vulnerabilities being frequently introduced, and malicious exploits can result in severe consequences like Denial of Service (DoS) or Remote Code Execution (RCE). Fuzz testing (fuzzing), particularly Syzkaller, has been instrumental in detecting vulnerabilities within the kernel. However, Syzkaller's effectiveness is hindered due to limitations in system call descriptions and initial seeds. In this paper, we propose Sunflower, an initial corpus generator that leverages existing exploits and proof-of-concept examples. Sunflower is specifically designed to meet the critical requirements of industry deployments by facilitating the construction of a high-quality seed corpus based on bugs found in the wild. By collecting and analyzing numerous real-world exploits responsible for kernel vulnerabilities, the tool extracts essential system call sequences while also rectifying execution dependency errors. This approach addresses a pressing industry need for more effective vulnerability assessment and exploit development, making it an invaluable asset for cybersecurity professionals. The evaluation shows that, with the help of Sunflower, we find a total number of 25 previously unknown vulnerabilities within the extensively tested Linux Kernel, while by augmenting Syzkaller with Sunflower, we achieve a 9.5% and 10.8% improvement on code coverage compared with the Syzkaller and Moonshine.