Windows Kernel Fuzzing

Attackers often rely on Windows kernel vulnerabilities to break out of application sandboxes and escalate privileges. To rapidly identify such vulnerabilities, we adapted techniques from browser fuzzing to assess the kernel and have reported a number of critical issues to Microsoft. All aspects of the fuzzer, from test case generation to testcase minimization are highly distributed and it produces high quality testcases for reproduction.

This talk discussed our approach for fuzz testing the Windows kernel, from assessing the kernel’s attack surface and effective test case generation, to the design and architecture of a highly distributed fuzzer that scales to many hundreds of CPU cores.