EDBT 2026 Demo / reviewers in the wild / expert
Zhenghang Xiao
dblp:351/5605
· DBLP profile ↗
3ranked-venue papers
0as first author
3since 2021 · last 2024
0009-0007-1209-6555ORCID · corroborated
Domains — the database's venue-derived domains; a paper can count in several
Security and privacy · 3 · 3 since 2021
| Year | Publication | Venue | Position |
|---|---|---|---|
| 2024 | KextFuzz: A Practical Fuzzer for macOS Kernel EXTensions on Apple SiliconabstractmacOS drivers, i.e., Kernel EXTensions (kexts), are attractive attack targets for adversaries. However, automatically discovering vulnerabilities in kexts is extremely challenging because kexts are mostly closed-source, and the latest macOS running on customized Apple Silicon has limited tool-chain support. Most existing static analysis and dynamic testing solutions cannot be applied to the latest macOS. In this paper, we present the first end-to-end fuzzing solution KextFuzz to detect bugs in the latest macOS kexts running on Apple Silicon. Unlike existing driver fuzzing solutions, KextFuzz does not require source code, execution traces, hypervisors, or hardware features (e.g., coverage tracing) and thus is universal and practical. We note that macOS has deployed many mitigations, including pointer authentication, code signature, and userspace kernel layer wrappers, to thwart potential attacks. These mitigations can provide extra knowledge and resources for us to enable kernel fuzzing. KextFuzz exploits these mitigation schemes to instrument the binary for coverage tracking, infer the type and semantic information of kext interfaces, and generate multi-dimension inputs. KextFuzz has found 49 unique kernel bugs in the macOS kexts and got five CVEs. Some bugs could cause severe consequences like running arbitrary code with kernel privilege. Tingting Yin, Zicong Gao, Zhenghang Xiao, Zheyu Ma, Chao Zhang 0008 |
IEEE Trans. Dependable Secur. Comput. | 3 |
| 2023 | Discovering and Understanding the Security Flaws of Authentication and Authorization in IoT Cloud APIs for Smart Home
Minglei Guo, Zhenghang Xiao, Jianwei Zhuge |
SecureComm (1) | 2 |
| 2023 | KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations
Tingting Yin, Zicong Gao, Zhenghang Xiao, Zheyu Ma, Chao Zhang 0008 |
USENIX Security Symposium | 3 |