System-security

Kernel Fuzzing

1. [CCS'21] SyzGen: Automated Generation of Syscall Specification of Closed-Source macOS Drivers
2. [Oakland'21] NTFUZZ: Enabling Type-Aware Kernel Fuzzing on Windows with Static Binary Analysis
3. [SOSP'21] HEALER: Relation Learning Guided Kernel Fuzzing
4. [SOSP'21] Snowboard: Finding Kernel Concurrency Bugs through Systematic Inter-thread Communication Analysis
5. [Oakland'22] GREBE: Unveiling Exploitation Potential for Linux Kernel Bugs

Kernel Bug Detection

Data Race

1. [Oakland'20] KRACE: Data Race Fuzzing for Kernel File Systems
2. [Oakland'19] Razzer: Finding Kernel Race Bugs through Fuzzing

Double-Fetch

1. [Security'19] Precise and Scalable Detection of Double-Fetch Bugs in OS Kernels
2. [Security'17] How Double-Fetch Situations turn into DoubleFetch Vulnerabilities: A Study of Double Fetches in the Linux Kernel

Missing check

1. [Security'19] Detecting Missing-Check Bugs via Semantic- and Context-Aware Criticalness and Constraints Inferences

Use Before Initialization

1. [ESEC/FSE'20] UBITect: a precise and scalable method to detect use-before-initialization bugs in Linux kernel
2. [CCS'16] UniSan: Proactive Kernel Memory Initialization to Eliminate Data Leakages

RefCount Bugs

1. [Security'21] Detecting Kernel Refcount Bugs with Two-Dimensional Consistency Checking

Undefined Behaviors

1. [NDSS'21] KUBO: Precise and Scalable Detection of User-triggerable Undefined Behavior Bugs in OS Kernel

Misc.

1. [Security'21] Static Detection of Unsafe DMA Accesses in Device Drivers
2. [CCS'21] CPscan: Detecting Bugs Caused by Code Pruning in IoT Kernels
3. [CCS'21] Statically Discovering High-Order Taint Style Vulnerabilities in OS Kernels

Kernel Bug Exploitation

Data Race

1. [Security'21] ExpRace: Exploiting Kernel Races through Raising Interrupts

Out-of-Bounds

1. [Security'20] KOOBE: Towards Facilitating Exploit Generation of Kernel Out-Of-Bounds Write Vulnerabilities

Use before initialization

1. [WOOT'20] Exploiting Uses of Uninitialized Stack Variables in Linux Kernels to Leak Kernel Pointers

Kernel Bug Repair

1. [Security'21] An Investigation of the Android Kernel Patch Ecosystem
2. [Security'21] Preventing Use-After-Free Attacks with Fast Forward Allocation

Kernel Debloating

1. [Security'21] SHARD: Fine-Grained Kernel Specialization with Context-Aware Hardening

Hypervisor Fuzzing

1. [Security'21] Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types
2. [CCS'21] Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization
3. [CCS'21] V-SHUTTLE: Scalable and Semantics-Aware Hypervisor Fuzzing
4. [Oakland'21] A Secure and Formally Verified Linux KVM Hypervisor

Fuzzing

1. [CCS'21] Same Coverage, Less Bloat: Accelerating Binary-only Fuzzing with Coverage-preserving Coverage-guided Tracing

Interests

1. PalmTree: Learning an Assembly Language Model for Instruction Embedding