3 ms·

Syzkaller fuzzes that stuff. https://github.com/google/syzkaller https://github.com/google/syzkaller

• rwmj 7y ago
  It fuzzes individual syscalls. Does it string them together into sequences? (Edit: yes it does, but it doesn't look for priv escalations, only crashes, kernel panics and the like)
  • deleted 7y ago
    [deleted]
  • londons_explore 7y ago
    When you have root, it doesn't take many more random syscalls to cause a panic.
    • chipb 7y ago
      Or just try a not-so-random one: kill(1, 9);
      • chipb 7y ago
        Huh. I guess it’s not too surprising, but that doesn’t work at all. init gets special treatment for signals. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/signal.c#n86 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/signal.c#n2659 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...
  • simcop2387 7y ago
    It can be adapted to privlege escalations, but it doesn't do it on it's own. You have to give it a stub to check after running the syscalls to check if the permissions are intact.
    • sitkack 7y ago
      Does it trace existing programs and use those as seeds in how to compose syscalls?
      • simcop2387 7y ago
        I don't think it's got the ability on it's own to do that, but I can imagine you could do it with strace and some other scripting.