Abstract:With the wide application and deployment of cloud computing in enterprises, virtualization developers and security researchers are paying more attention to cloud computing security. The core component of cloud computing products is the hypervisor, which is also known as the virtual machine monitor (VMM) that can isolate multiple virtual machines in one host machine. However, compromising the hypervisor can lead to virtual machine escape and the elevation of privilege, allowing attackers to gain the permission of code execution in the host. Therefore, the security analysis and vulnerability detection of the hypervisor are critical for cloud computing enterprises. Importantly, virtual devices expose many interfaces to a guest user for communication, making virtual devices the most vulnerable part of a hypervisor. However, applying fuzzing to the virtual devices of a hypervisor is challenging because the data structures transferred by DMA are constructed in a nested form according to protocol specifications. Failure to understand the protocol of the virtual devices will make the fuzzing process stuck in the initial fuzzing stage, resulting in inefficient fuzzing. In this paper, we propose a new framework called V-Shuttle to conduct hypervisor fuzzing, which performs scalable and semantics-aware hypervisor fuzzing. To address the above challenges, we first design a DMA redirection mechanism to significantly reduce the manual efforts to reconstruct virtual devices' protocol structures and make the fuzzing environment setup automated and scalable. Furthermore, we put forward a new fuzzing mutation scheduling mechanism called seedpool to make the virtual device fuzzing process semantics-aware and speed up the fuzzing process to achieve high coverage. Extensive evaluation on QEMU and VirtualBox, two of the most popular hypervisor platforms among the world, shows that V-Shuttle can efficiently reproduce existing vulnerabilities and find new vulnerabilities. We further carried out a long-term fuzzing campaign in QEMU/KVM and VirtualBox with V-Shuttle. In total, we discovered 35 new bugs with 17 CVEs assigned.

Software Simulation-Based Fault Injection Tool of Virtual Machine System

Simics-based System Level Fault Injection Platform

Analog Circuit Simulation Approach with Multi-Fault Injector

Analog Circuit Fault Simulation Approach Based on Pspice Engine

THE IMPLEMENTATION OF FAULTS DEBUGGING AND DETECTION BASED ON VXWORKS

VIDEZZO: Dependency-aware Virtual Device Fuzzing

Design and Implementation of Virtual Test System Based on LabWindows/CVI

Study of Fault-Injection for FPGA Based Fault-Tolerant Computer

A Fault Injection and Formal Verification Framework Based on UML Sequence Diagrams

Study on Intelligent Fault Diagnosis of Engine Based on Virtual Instrument Technology

SIMULATION-BASED NETWORK FAULT INJECTION IN THE CLOUDSIM PLUS CLOUD SIMULATION ENVIRONMENT

A Software Vulnerability Analysis Environment Based on Virtualization Technology

A Virtual Testing Framework for Real-Time Validation of Automotive Software Systems Based on Hardware in the Loop and Fault Injection

Modeling and Application of Virtual Machine Tool

System level fault simulation algorithm and system SysFsim for VLSI system on a chip

Virtualization: System-Level Fault Simulation of SRAM Errors in Automotive Electronic Control Systems

Virtual Instrument System Of State Monitoring And Fault Diagnosis

Study and Analysis of Defect Amplification Index in Technology Variant Business Application Development through Fault Injection Patterns

A Micro Architectural Events Aware Real-Time Embedded System Fault Injector

Towards Formal Fault Injection for Safety Assessment of Automated Systems

V-Shuttle - Scalable and Semantics-Aware Hypervisor Virtual Device Fuzzing.