`perf_fuzzer` perf_event syscall fuzzer

News

As of the upcoming Linux 5.0 release, it is *finally* (after 6 years) possible to fuzz indefinitely on recent Intel x86 machines without crashing. This is a great development, both for security reasons, but also means now it is finally going to be in theory a lot easier to bisect new bugs.

Background

The perf_fuzzer tool automatically tests the perf_event_open() system call and attempts to find mostly-valid inputs that potentially crash (or worse) the Linux kernel.

The fuzzer has found 28 serious bugs in the Linux kernel which have all been fixed.

See the publications section below for more documentation.

Hacker Note

Please send me an e-mail if you use perf_fuzzer and find bugs!

It's a struggle trying to get publications/funding for this work, which is one of the reasons why development has slowed. If you've used perf_fuzzer to get a CVE or bug bounty, please let me know so I can use the info in my reports to show how important fuzzing can be.

For example, CVE-2015-0805, CVE-2015-0819 (major Qualcomm Android root exploits found by Wish Wu, possibly with the perf_fuzzer, but I couldn't verify this for sure. See here and here)

Bugs Found

The code has already found numerous denial of service bugs and various local root exploits. At least five CVE entries were directly a result of this work, and many more probably are (but are harder to verify).

See here for a list of current/fixed mainline Linux kernel bugs found.

Publications

I have not had much success getting this work published in any "real" academic venue. USENIX security says it is incremental and thus uninteresting. The NSF was uninterested in funding this as well. (Though reviewers often stress this is important work and I should keep working on it in my free time).

The first academic publication was at the First Annual Workshop on Cyber Security in High Performance Computing (S-HPC'22)
I (remotely) presented the paper at the workshop (co-located with Supercomputing): 2022_shpc_fuzzer.pdf (18 November 2022)
The most recent Tech Report can be found here: 2019_perf_fuzzer_tr.pdf (15 February 2019)
An update on the status of perf_fuzzer was presented at the 2016 Linux Plumber's conference:
- November 2016 perf_fuzzer update (18 November 2016)
- Slides for my talk if I had needed them: linuxplumbers2016_weaver.pdf
- LWN coverage of the fuzzer talks: A trio of Fuzzers (9 November 2016)
An article on the perf_fuzzer appeared on LWN.net:
Fuzzing perf_events (5 August 2015)
An older Tech Report describing the design of the fuzzer can be found here:
2015_perf_fuzzer_tr.pdf (12 May 2015).

Code

The perf_fuzzer is available as part of the perf_event_test test suite.

Currently development is done via git at https://github.com/deater/perf_event_tests ; you can check out a version of the development tree via:

git clone git://github.com/deater/perf_event_tests

Read the README

Back to unofficial perf_events page

perf_fuzzer perf_event syscall fuzzer