WIP: QKSAN: Towards Multiple Sanitizers for In-vehicle COTS OS Kernels

With the rise of smart vehicles, increasingly intelligent in-vehicle systems are also exposing security issues, where traditional software vulnerabilities are demonstrating greater harm. Fuzzing is still an effective means to mitigate the risks of system software vulnerabilities. However, due to the fact that in-vehicle commercial off-the-shelf (COTS) system software is typically closed-source, conducting fuzzing on it presents significant challenges. The lack of information and the difficulty of modifying the system make it hard to implement effective fuzzing oracles.

To address these issues, we propose QKSAN, a sanitizer framework suitable for binary-only kernels. QKSAN innovatively combines multiple types of sanitizers and employs an efficient hypervisor-level instrumentation method to detect memory violation bugs such as out-of-bound accesses and the use of uninitialized variables. Experiments have demonstrated that QKSAN can successfully detect various vulnerabilities in binary kernels like Linux and QNX and feasibly be applied to real-world systems fuzzing.