USBFuzz: A Framework for Fuzzing USB Drivers by Device EmulationThe Universal Serial Bus (USB) connects external devices to a host. This interface exposes the OS kernels and device drivers to attacks by malicious devices. Unfortunately, kernels and drivers were developed under a security model that implicitly trusts connected devices. Drivers expect faulty hardware but not malicious attacks. Similarly, security testing drivers is challenging as input must cross the hardware/software barrier. Fuzzing, the most widely used bug finding technique, relies on providing random data to programs. However, fuzzing device drivers is challenging due to the difficulty in crossing the hardware/software barrier and providing random device data to the driver under test.
We present USBFuzz, a portable, flexible, and modular framework for fuzz testing USB drivers. At its core, USBFuzz uses a software-emulated USB device to provide random device data to drivers (when they perform IO operations). As
the emulated USB device works at the device level, porting it to other platforms is straight-forward. Using the USBFuzz framework, we apply (i) coverage-guided fuzzing to a broad
range of USB drivers in the Linux kernel; (ii) dumb fuzzing
in FreeBSD, MacOS, and Windows through cross-pollination
seeded by the Linux inputs; and (iii) focused fuzzing of a
USB webcam driver. USBFuzz discovered a total of 26 new
bugs, including 16 memory bugs of high security impact in
various Linux subsystems (USB core, USB sound, and net-
work), one bug in FreeBSD, three in MacOS (two resulting in
an unplanned reboot and one freezing the system), and four
in Windows 8 and Windows 10 (resulting in Blue Screens of
Death), and one bug in the Linux USB host controller driver
and another one in a USB camera driver. From the Linux
bugs, we have fixed and upstreamed 11 bugs and received 10 CVEs
http://hexhive.epfl.ch/publications/files/20SEC3.pdf