GREBE

GREBE is an object-driven tool to identify Multiple Error Behavior of kernel bugs. GREBE consists of two components -- a static analysis tool to identify critical kernel objects of triggering the bug, and a fuzzing tool based Syzkaller to find its other error behavior. Refer to our paper for more details.

Usage scenario

You find a low-severity bug in kernel, and would like to know the true effect of the bug. Examples: CVE-2021-3715

You find a high-severity bug, and would like to know the bug's other memory corruption capability.

How to use fuzzer

Identify critical objects with the analyzer

see here

Patch kernel to support object coverage feedback

patch [target_kernel_dir]/kernel/kcov.c -p1 < ./kernel.patch

Build kernel with our gcc

export OBJ_FILE=[the_absolute_path_to_the_file_containing_critical_objects]
make CC=[path_to_our_gcc] -j`nproc`

Run the fuzzer

The fuzzer works like Syzkaller. It is noted that you should pass a POC to the syz-manager with -auxiliary flag.

Acknowledge

@INPROCEEDINGS{9833683,
author={Lin, Zhenpeng and Chen, Yueqi and Wu, Yuhang and Mu, Dongliang and Yu, Chensheng and Xing, Xinyu and Li, Kang},
booktitle={2022 IEEE Symposium on Security and Privacy (SP)},
title={GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs},
year={2022},
pages={2078-2095},
doi={10.1109/SP46214.2022.9833683}
}

About

Languages

Language:C 44.7%Language:Ada 15.5%Language:C++ 13.9%Language:Go 7.8%Language:D 6.0%Language:GCC Machine Description 3.7%Language:Fortran 2.3%Language:Makefile 1.7%Language:Roff 0.9%Language:Assembly 0.8%Language:HTML 0.7%Language:M4 0.5%Language:Shell 0.4%Language:Objective-C 0.3%Language:Python 0.1%Language:Objective-C++ 0.1%Language:TeX 0.1%Language:RPC 0.1%Language:Scilab 0.1%Language:Awk 0.0%Language:Perl 0.0%Language:Logos 0.0%Language:Pascal 0.0%Language:C# 0.0%Language:Pawn 0.0%Language:DIGITAL Command Language 0.0%Language:Vim Script 0.0%Language:Yacc 0.0%Language:OCaml 0.0%Language:PHP 0.0%Language:POV-Ray SDL 0.0%Language:CMake 0.0%Language:Standard ML 0.0%Language:Lex 0.0%Language:Ragel 0.0%Language:Dockerfile 0.0%Language:Smarty 0.0%Language:Haskell 0.0%Language:CSS 0.0%Language:SourcePawn 0.0%Language:SAS 0.0%Language:JavaScript 0.0%Language:Java 0.0%Language:Module Management System 0.0%Language:Emacs Lisp 0.0%Language:R 0.0%Language:SWIG 0.0%Language:GDB 0.0%Language:Forth 0.0%Language:DTrace 0.0%Language:Brainfuck 0.0%Language:Batchfile 0.0%