MundoFuzz: Hypervisor Fuzzing with Statistical Coverage Testing and Grammar Inference

A hypervisor is system software, managing and running virtual machines. Since the hypervisor is placed at the lowestlevel in the typical systems software stack, it has critical security implications. Once compromised, the entire software components running on top of the hypervisor (including all guest virtual machines and applications running within each guest virtual machine) are compromised as well, as the hypervisor has all the privileges to access those. This paper proposes MUNDOFUZZ, a hypervisor fuzzer to enable both coverage-guided and grammar-aware fuzzing. We find that the coverage measurement in hypervisors suffers from noises due to the hypervisor's asynchronous system event handling. In order to filter out such noises, MUNDOFUZZ develops a statistical differential coverage measurement methods, allowing MUNDOFUZZ to capture the clean coverage information for hypervisor inputs. Moreover, we observe that hypervisor inputs have complex input grammars because it supports many different devices and each device has its own input format. Thus, MUNDOFUZZ learns the input grammar through inspecting the coverage characteristics of the given hypervisor input, which is based on the idea that the hypervisor behaves in a different way if the grammatically correct (or incorrect) input is given. We evaluated MUNDOFUZZ with popular hypervisors, QEMU and Bhyve, and MUNDOFUZZ outperformed other state-of-the-art hypervisor fuzzers ranging from 4.91% to 6.60% in terms of coverage. More importantly, MUNDOFUZZ identified 40 previously unknown bugs (including 9 CVEs), demonstrating its strong practical effectiveness in finding real-world hypervisor vulnerabilities. * Corresponding author which enables a single host machine to run multiple guest VMs. This advantage becomes particularly important as the computing trends are rapidly shifting towards cloud computing. Using the hypervisor, cloud computing platforms can facilitate flexible resource managements on virtualized platforms, which can efficiently service for billions of users [18] . From the security point of view, hypervisors introduce crucial attack surface to be protected. Importantly, a hypervisor is running at the lowest layer in the typical systems software stack, so it is given the highest security privilege of the host machine. Consequently, any successful compromise exploiting hypervisor vulnerabilities would allow attackers to gain privilege of the entire host machine, including the hypervisor itself as well as all guest VMs running on top of them.