Table of Contents

• 1. Linux Kernel Enriched Corpus for Fuzzers
  • 1.1. Using Enriched corpus with Syzkaller
  • 1.2. Using Enriched corpus with HEALER
  • 1.3. Citing
  • 1.4. DIY
    • 1.4.1. Fetching Corpus Manually
    • 1.4.2. Generating corpus.db File
  • 1.5. Corpus Files Available
  • 1.6. Results
    • 1.6.1. Coverage over time
    • 1.6.2. Unique Crashes over time
    • 1.6.3. Total Crashes over time
    • 1.6.4. CVEs:
    • 1.6.5. New Bugs Reported:
    • 1.6.6. More bugs discovered (includes bugs that were found sooner than syzbot & bugs undiscovered by syzbot)

Documentation for using and generating the Enriched corpus provided here.

For more questions, feel free to email Palash Oswal or Rohan Padhye.

The latest copy of the Corpus file corpus.db is available in the releases for this repository. The file is updated daily.

Download it to syzkaller workdir and start syzkaller.

mkdir workdir
cd workdir
wget https://github.com/cmu-pasta/linux-kernel-enriched-corpus/releases/download/latest/corpus.db

The corpus programs are stored in files directory and can directly be imported to HEALER.

Clone the repository and copy over files/* to output/corpus/ directory in HEALER. From within HEALER working directory, run the following commands.

mkdir -p output/corpus
cp -vr <path/to/files/> output/corpus/

Please use the following BibTeX to cite enriched corpus.

@phdthesis{
author={Oswal,Palash B.},
year={2023},
title={Improving Linux Kernel Fuzzing},
journal={ProQuest Dissertations and Theses},
pages={43},
isbn={9798379515645},
language={English},
url={https://www.proquest.com/dissertations-theses/improving-linux-kernel-fuzzing/docview/2812311865/se-2},
} 

collect.py : currently fetches syz reproducers from all fixed Linux Kernel upstream crashes in syzbot.

This script can be modified to fetch corpus programs from other kernel versions and to fetch "C" Programs instead of syz reproducers.

If you have a collection of syz programs that need to be converted to a syzkaller comptaible corpus.db file, you can use syz-db.go pack from syzkaller.

An implementation of this is available in the GitHub actions workflow here.

1. corpus.db : Enriched Corpus (version 0 for syz-db)
2. ci-qemu-upstream-corpus.db : Corpus Obtained from Syz-CI (Google's syzbot) (version latest per syz-db)
3. enriched-ci-qemu-upstream-corpus.db : Enriched Version of the Corpus Obtained from Syzbot (version 0 for syz-db) A detailed comparison of the three is provided in the research document. More documentation to follow.

Experiments performed by fuzzing 1 instance using 2VCPUs and 4GB RAM for 24 hours. Corpus comparison experiments performed with 8 such VMs.

System Used : ThinkMate, Intel® Xeon® Gold 6226R.

Kernel Versions Tested: Linux v6.0.8 and v6.1.20

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

1 VM (2vCPU and 4G RAM) for 24 hours.

8 VM (2vCPU and 4G RAM) for 24 hours.

• CVE-2023-26544
• CVE-2023-26605
• CVE-2023-26606
• CVE-2023-26607

• https://lkml.org/lkml/2023/2/20/128
• https://lkml.org/lkml/2023/2/20/773
• https://lkml.org/lkml/2023/2/20/785
• https://lkml.org/lkml/2023/2/20/860
• https://lkml.org/lkml/2023/2/21/1353
• https://lkml.org/lkml/2023/2/22/3
• https://lkml.org/lkml/2023/4/13/39
• https://lkml.org/lkml/2023/4/13/45
• https://lkml.org/lkml/2023/4/13/1317
• https://lkml.org/lkml/2023/4/13/1350
• https://lkml.org/lkml/2023/6/3/90
• https://lkml.org/lkml/2023/6/3/91
• https://lkml.org/lkml/2023/6/3/95
• https://lkml.org/lkml/2023/6/3/98
• https://lkml.org/lkml/2023/6/3/146
• https://lkml.org/lkml/2023/6/3/148 and many more