KernelGPT：通过大语言模型增强内核模糊测试
KernelGPT: Enhanced Kernel Fuzzing via Large Language Models
AI总结：
本文提出 KernelGPT，利用大语言模型基于代码、文档与验证反馈迭代推断并修复 syscall 规范，从而增强 Linux 内核模糊测试，提升覆盖率并发现 24 个新漏洞。
摘要：
操作系统内核中的漏洞可能影响全球数十亿台设备和用户。因此，大量研究集中于内核模糊测试，即自动生成 syscall（系统调用）序列以检测潜在的内核漏洞或缺陷。内核模糊测试旨在依据定义了 syscall 语法和语义的 syscall 规范，生成有效的 syscall 序列。尽管已有工作尝试自动化 syscall 规范生成，但这在很大程度上仍依赖人工，且大量重要 syscall 仍未被覆盖。本文提出 KernelGPT，这是首个通过大语言模型（LLM）自动合成 syscall 规范以增强内核模糊测试的方法。其核心洞见是，LLM 在预训练期间已见过大量内核代码、文档和用例，因此能够自动提炼构造有效 syscall 所需的信息。更具体地说，KernelGPT 采用迭代方法自动推断规范，并根据验证反馈进一步调试和修复规范。结果表明，KernelGPT 能够生成更多新的有效规范，并实现高于现有最先进技术的覆盖率。迄今为止，借助新生成的规范，KernelGPT 已在 Linux 内核中发现 24 个新的独特漏洞，其中 12 个已修复，11 个被分配 CVE 编号。此外，应内核模糊测试工具 Syzkaller 开发团队的请求，KernelGPT 生成的若干规范已被合并至该工具中。
英文摘要：
Bugs in operating system kernels can affect billions of devices and users all over the world. As a result, a large body of research has been focused on kernel fuzzing, i.e., automatically generating syscall (system call) sequences to detect potential kernel bugs or vulnerabilities. Kernel fuzzing aims to generate valid syscall sequences guided by syscall specifications that define both the syntax and semantics of syscalls. While there has been existing work trying to automate syscall specification generation, this remains largely manual work, and a large number of important syscalls are still uncovered. In this paper, we propose KernelGPT, the first approach to automatically synthesizing syscall specifications via Large Language Models (LLMs) for enhanced kernel fuzzing. Our key insight is that LLMs have seen massive kernel code, documentation, and use cases during pre-training, and thus can automatically distill the necessary information for making valid syscalls. More specifically, KernelGPT leverages an iterative approach to automatically infer the specifications, and further debug and repair them based on the validation feedback. Our results demonstrate that KernelGPT can generate more new and valid specifications and achieve higher coverage than state-of-the-art techniques. So far, by using newly generated specifications, KernelGPT has already detected 24 new unique bugs in Linux kernel, with 12 fixed and 11 assigned with CVE numbers. Moreover, a number of specifications generated by KernelGPT have already been merged into the kernel fuzzer Syzkaller, following the request from its development team.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
