syzkaller
Coverage-guided syscall fuzzer for Linux and other kernels, with declarative syscall descriptions.
Technical Architecture & Overview
syzkaller fuzzes operating system kernels by generating sequences of syscalls from syzlang descriptions, guided by KCOV coverage, and it runs targets in managed VMs so crashes are captured and deduplicated automatically. It supports Linux primarily, with FreeBSD, NetBSD, OpenBSD, Fuchsia, gVisor, and Windows backends, and its syzbot service reports found bugs to kernel developers. Setup requires a coverage-enabled kernel and VM configuration.
Targeted Technical Use Cases
Kernel and driver security testing with a maintained corpus and reproducible crash reporting.
Evaluation & Trade-offs
Core Strengths
- +Declarative syzlang descriptions of syscall interfaces.
- +Crash deduplication and repro generation built in.
- +Multi-OS backends beyond Linux.
Trade-Offs & Limitations
- -Significant setup effort: VMs, coverage kernels, and corpora.
- -Syscall descriptions need updates for new kernel features.
Defensive Security Application
Finding kernel bugs before they ship in production kernels.
Frequently Asked Questions
What is syzkaller?→
syzkaller fuzzes operating system kernels by generating sequences of syscalls from syzlang descriptions, guided by KCOV coverage, and it runs targets in managed VMs so crashes are captured and deduplicated automatically. It supports Linux primarily, with FreeBSD, NetBSD, OpenBSD, Fuchsia, gVisor, and Windows backends, and its syzbot service reports found bugs to kernel developers. Setup requires a coverage-enabled kernel and VM configuration.
What is syzkaller used for?→
Kernel and driver security testing with a maintained corpus and reproducible crash reporting.
What are the strengths of syzkaller?→
- +Declarative syzlang descriptions of syscall interfaces.
- +Crash deduplication and repro generation built in.
- +Multi-OS backends beyond Linux.
What are the limitations of syzkaller?→
- +Significant setup effort: VMs, coverage kernels, and corpora.
- +Syscall descriptions need updates for new kernel features.
How is syzkaller used defensively?→
Finding kernel bugs before they ship in production kernels.