Zhenghang Xiao

dblp:351/5605 · DBLP profile ↗
← Back
3ranked-venue papers
0as first author
3since 2021 · last 2024
0009-0007-1209-6555ORCID · corroborated

Domains — the database's venue-derived domains; a paper can count in several

Security and privacy · 3 · 3 since 2021
YearPublicationVenuePosition
2024 KextFuzz: A Practical Fuzzer for macOS Kernel EXTensions on Apple Silicon
abstract
macOS drivers, i.e., Kernel EXTensions (kexts), are attractive attack targets for adversaries. However, automatically discovering vulnerabilities in kexts is extremely challenging because kexts are mostly closed-source, and the latest macOS running on customized Apple Silicon has limited tool-chain support. Most existing static analysis and dynamic testing solutions cannot be applied to the latest macOS. In this paper, we present the first end-to-end fuzzing solution KextFuzz to detect bugs in the latest macOS kexts running on Apple Silicon. Unlike existing driver fuzzing solutions, KextFuzz does not require source code, execution traces, hypervisors, or hardware features (e.g., coverage tracing) and thus is universal and practical. We note that macOS has deployed many mitigations, including pointer authentication, code signature, and userspace kernel layer wrappers, to thwart potential attacks. These mitigations can provide extra knowledge and resources for us to enable kernel fuzzing. KextFuzz exploits these mitigation schemes to instrument the binary for coverage tracking, infer the type and semantic information of kext interfaces, and generate multi-dimension inputs. KextFuzz has found 49 unique kernel bugs in the macOS kexts and got five CVEs. Some bugs could cause severe consequences like running arbitrary code with kernel privilege.
Tingting Yin, Zicong Gao, Zhenghang Xiao, Zheyu Ma, Chao Zhang 0008
IEEE Trans. Dependable Secur. Comput.3
2023 Discovering and Understanding the Security Flaws of Authentication and Authorization in IoT Cloud APIs for Smart Home
Minglei Guo, Zhenghang Xiao, Jianwei Zhuge
SecureComm (1)2
2023 KextFuzz: Fuzzing macOS Kernel EXTensions on Apple Silicon via Exploiting Mitigations
Tingting Yin, Zicong Gao, Zhenghang Xiao, Zheyu Ma, Chao Zhang 0008
USENIX Security Symposium3