Coverage-guided USB fuzzing with Syzkaller | OffensiveCon 2019

A talk about creating a syzkaller extension for finding Linux kernel vulnerabilities that can be exploited externally by a malicious USB device. I show how I used the USB Gadget subsystem for emulating USB devices and extended KCOV to collect coverage from USB packet parsing paths. Slides: https://docs.google.com/presentation/... Twitter:   / andreyknvl   Website: https://xairy.io/ 00:00 Intro 01:48 Agenda 02:18 Syzkaller overview 16:04 USB overview 24:16 USB fuzzing with Syzkaller 38:14 Demo: USB fuzzing in progress 40:00 Demo: running reproducers in a VM 41:19 Linux kernel USB fuzzing results 43:43 Hardware reproducers 45:21 Demo: crashing Linux over USB 49:16 Bonus 50:27 Demo: crashing Windows over USB 52:50 Thanks and questions