Under the monolithic architecture of the Linux kernel, all its components operate within the same address space. Notably, device drivers constitute over half of the kernel codebase yet are particularly prone to bugs. Therefore, exploring vulnerabilities in drivers is critical for ensuring kernel security. Extensive research has been done to fuzz kernel drivers through system calls and hardware interrupts. Through a comprehensive study of the Linux Kernel Device Model, we identified that the execution of device drivers is also influenced by runtime parameters, including device attributes and kernel module parameters. Our analysis reveals that large portions of the uncovered code are masked by these parameters, which are exposed to the userspace through a specialized virtual file system known as sysfs. Furthermore, adjacent devices interconnected within the same device tree also impact drivers' behavior.

The Linux kernel remains vulnerable to numerous bugs, with approximately 65% detected by Syzkaller lacking Proof-of-Concept (PoC), hampering risk mitigation efforts. These bugs, termed irreproducible kernel bugs, highlight the challenge of statefulness issue-related irreproducibility in kernel fuzzing, which is an open research without definitive solutions. Our investigation reveals that suboptimal seed quality distribution in fuzzing is the root obstacle preventing effective tracking of the states leading to crashes. Inspired by this insight, we introduce Reverse Fuzzing (RF), an innovative approach that infers hard-to- reach states by continuously reverse-oriented deriving from subsequently encountered bridge states to increase reproduction probability. RF differentiates between the “trigger” seed, which directly causes crashes, and “activator” seeds, which establish the necessary preconditions, prioritizing exploration around trigger while simultaneously regenerating and maintaining activators during fuzzing, which effectively facilitate to restructure such elusive states from “yesterday”. We implement YOME, a prototype leveraging RF to strike a balance between fuzzing efficiency and effectiveness through customized scheduling and mutation strategies, armed with a refinement mechanism to improve seed quality distribution. Our evaluations validate that YOME reproduce 110% more bugs than previous kernel fuzzers and demonstrate its practicality in real-world scenarios. YOME generated 125 PoCs (30.1% of the total) and uncovered 23 unique bugs, with 40 confirmed and 5 assigned CVEs.

Combining multiple-input multiple-output (MIMO) and orthogonal frequency-division multiplexing (OFDM) techniques, interference alignment (IA) enables concurrent transmission of multiple data streams with interference-free, and enormously enhances the system throughput. In this paper, we first explore the channel character of diagonal-block, to achieve the optimal DoF using IA in $K$-user MIMO-OFDM systems. With finite frequency extensions, the total normalized degree of freedom (DoF) can be achieved by $\frac{K}{2}$. Furthermore, we provide the closed-form precoding and filtering matrices, without complex iteration. Simulation reveals the sum-rate performance we achieved is higher than that in previous works, and the complexity of closed-form solution is much lower than that of iterative algorithms.

This paper presents a novel approach for interest point and region detection which is invariant to affine transformations. Such transformations introduce significant changes in the point location as well as in the scale and the shape of the neighborhood of an interest point. Our approach allows to solve for these problems simultaneously. The approach is based on three key ideas: 1) Interest points can be extracted based on local maxima of the normalized local energy maps. 2) Local extrema over scale of the normalized energy function indicate the presence of characteristic local structures. 3) The maximum response along all the orientations indicates the principle orientation of the local structure. We first extract interest points at multi-scales from the local energy map constructed by Gabor filter responses, and then select points at which a local measure is maximal over scales. This allows a selection of distinctive points for which the characteristic scale is known. We then estimate the principle orientation through the orientational responses of Gabor filters and extend the detector to affine invariance by estimating the affine shape of a point neighborhood. The characteristic scale and the affine shape of neighborhood determine an affine invariant region for each point. Experimental results with synthetic images and natural images show the affine invariance performance of our approach. Comparative evaluation using the repeatability criteria demonstrates the comparable performance in the presence of large viewpoint changes.