状态感知的可信执行环境内核模糊测试方法OA

Trusted execution environment(TEE)is widely used,and its kernel security has become a significant area of focus.Fuzzing,a powerful technique for detecting vulnerabilities in operating system,has increasingly been applied to the security analysis of TEE.However,conventional fuzzing tools cannot be directly used for TEE kernels due to their isolation.Coverage-guided fuzzers often discard test cases that trigger new states but cover the same code,which limits their effectiveness in discovering vulnerabilities.To address these challenges,a state-aware fuzzing method tailored for TEE kernels is proposed.Initially,a modeling and tracing approach is developed to represent the program state through state-variable values and retaining the test cases that trigger new states,overcoming the limitations of coverage-guided fuzzers.Subsequently,we introduce an innovative communication scheme to tackle issues arising from TEE isolation.New seed retention and selection algorithms are proposed to better guide the fuzzer in exploring vulnerabilities.Finally,the N-Gram model is employed to enhance test case generation and optimize the framework's performance.A prototype,named Trusty-Statefuzz,has been implemented and evaluated on fuchsia,the self-developed microkernel operating system Nebula,and OP-TEE.The evaluation results show that Trusty-Statefuzz is effective at detecting both new code and vulnerabilities.Trusty-Statefuzz discovers 9 unknown vulnerabilities and 23 known vulnerabilities.Additionally,it achieves 13％higher code coverage and 27％higher state coverage than the state-of-the-art fuzzer Syzkaller.