google/syzkaller
Syzkaller
Syzkaller is an unsupervised, coverage-guided kernel fuzzer that automatically generates and mutates system call sequences to find bugs in operating system kernels. It operates without human intervention, using a closed feedback loop of input generation, execution, crash detection, and corpus refinement to continuously explore kernel code paths.
The fuzzer distinguishes itself by supporting multiple operating system kernels, including Linux, FreeBSD, and Windows, through per-platform syscall harnesses that abstract system call interfaces behind a common driver. It uses declarative descriptions of syscall arguments, structures, and constraints to produce valid and semantically meaningful inputs for each target OS, while parallel VM-based execution distributes workloads across isolated kernel instances to maximize throughput.
Syzkaller maintains a persistent corpus of interesting inputs, using coverage metrics to rank and evolve them for deeper kernel exploration. Crash reports are collected, deduplicated by stack trace or other signatures, and grouped into related bugs for efficient developer review. The project provides documentation and installation guidance for setting up fuzzing campaigns across supported platforms.
Features
- Unsupervised Kernel Fuzzers - Syzkaller fuzzes operating system kernels by automatically generating and mutating system call sequences to find bugs without human supervision.
- Coverage-Guided Fuzzers - A fuzzer that uses code coverage feedback to steer input generation toward unexplored kernel paths.
- Coverage-Guided Fuzzing - Syzkaller guides fuzzing by using code coverage signals to steer input generation toward unexplored kernel paths and increase bug yield.
- Multi-OS Kernel Fuzzers - A fuzzer that supports Linux, FreeBSD, Windows, and other OS kernels with per-platform harnesses.
- Multi-OS Kernel Fuzzers - Running the same fuzzing engine across Linux, FreeBSD, Windows, and other OS kernels with per-platform harnesses.
- Kernel-Specific Syscall Harnesses - Abstracts system call interfaces and kernel-specific harnesses behind a common driver, enabling the same fuzzer to target Linux, FreeBSD, and Windows.
- Unsupervised Fuzzing Loops - Automatically runs a closed feedback cycle of input generation, execution, crash detection, and corpus refinement without human intervention.
- Coverage-Guided Mutation - Generates and mutates sequences of system calls, using kernel code coverage feedback to prioritise inputs that reach new execution paths.
- Coverage-Ranked Input Prioritization - Maintains a persistent corpus of interesting inputs, using coverage metrics to rank and evolve them for deeper kernel exploration.
- Declarative System Call Descriptions - Uses declarative descriptions of syscall arguments, structures, and constraints to generate valid and semantically meaningful inputs for each target OS.
- Parallel VM-Based Execution - Distributes fuzzing workloads across multiple virtual machines, each running isolated kernel instances to maximise throughput and avoid state interference.
- Multi-OS Kernel Fuzzers - Syzkaller runs the same fuzzing engine across Linux, FreeBSD, Windows, and other OS kernels with per-platform harnesses.
- Crash Deduplication and Triaging - Collects crash reports, deduplicates them by stack trace or other signatures, and groups related bugs for efficient developer review.
- Fuzzing Frameworks - Distributed, coverage-guided fuzzer for Linux kernel syscalls.
- Fuzzing Tools - Kernel-level fuzzer for discovering vulnerabilities in operating systems.
- Kernel Fuzzers - Unsupervised coverage-guided kernel fuzzer.
- Kernel Fuzzing Tools - Unsupervised coverage-guided fuzzer for multiple operating system kernels.
- Security Tools - Unsupervised, coverage-guided kernel fuzzer.
