My long-term project is writing a kernel fuzzer named lxfuzz. It is a coverage-guided fuzzer for the linux kernel. I chose that project for some reasons:
- To learn about fuzzing, its mechanisms etc. in general
- To learn more about the linux kernel, especially
- To improve my C++ skills :) (the language used for lxfuzz)
- Profit (finding CVEs)
Under the hood it’s using qemu to run the kernel and KCOV for coverage collection. The project is still work-in-progress and developed gradually. Current features are:
- Testing syscalls, char devices, sockets, …
- Running multiple instaces each assigned cpu cores and memory
- Freedom in running the kernel, highly configurable
- Coverage collection through the kcov framework
- Using hypercalls for fast data transfer between guest and host
- A basic mutator and logging functionality
- Kernel panic saving and a crash reproducer
- Making use of user namespaces and/or running as a daemon
- And more to come
You can find the current state of development on GitHub as well as some more info. Feel free to reach out on me for any questions/advice/etc. :)