Hybrid fuzzing, combining symbolic execution and fuzzing, is a promising approach for
vulnerability discovery because each approach can complement the other. However, we …

Missing a security check is a class of semantic bugs in software programs where erroneous
execution states are not validated. Missing-check bugs are particularly common in OS …

Although it is common practice for kernel fuzzers to leverage type information of system
calls, current Windows kernel fuzzers do not follow the practice as most system calls are …

Permission checks play an essential role in operating system security by providing access
control to privileged functionalities. However, it is particularly challenging for kernel …

With growing hardware complexity and ever-evolving user requirements, the kernel is
increasingly bloated which increases its attack surface. Despite its large size, for specific …

Probabilistic classification has shown success in detecting known types of software bugs.
However, the works following this approach tend to require a large amount of specimens to …

A bug is a vulnerability if it has security impacts when triggered. Determining the security
impacts of a bug is important to both defenders and attackers. Maintainers of large software …

Direct Memory Access (DMA) is a popular mechanism for improving hardware I/O
performance, and it has been widely used by many existing device drivers. However, DMA …

Discovering kernel concurrency bugs through fuzzing is challenging. Identifying kernel
concurrency bugs, as opposed to non-concurrency bugs, necessitates an analysis of …

Existing tools for the automated detection of memory corruption bugs are not very effective in
practice. They typically recognize only standard memory management (MM) APIs (eg …