Hybrid kernel fuzzing combines kernel fuzzing and symbolic execution: symbolic execution resolves hard-to-reach branch conditions, while kernel fuzzing mitigates path explosion. This collaboration has shown strong potential for uncovering deep kernel vulnerabilities. However, existing approaches have not fully accounted for the challenges introduced by the kernel’s persistent state, concurrent task execution, and large codebase, leading to (1) inconsistent execution environments between fuzzer and symbolic engine, (2) excessive symbolic tracking overhead, and (3) inefficient constraint solving. We present SymSyz, a hybrid kernel fuzzing framework that addresses these challenges with three techniques: Snapshot-Driven Environment Synchronization for state consistency, Origin-Scoped Symbolic Execution to reduce symbolic tracking overhead, and Priority-Guided Constraint Solving to improve solving efficiency. As a result, SymSyz improves coverage by up to 27%, achieves equivalent coverage levels with a speedup of up to $2.2\times $ , and delivers a symbolic tracking speedup of $5.6\times $ compared to the state-of-the-art kernel fuzzers. It detected 9 additional bugs on a legacy kernel and 13 previously unknown bugs on the latest Linux kernel, with 4 confirmed and 2 CNNVD IDs assigned.
Lu Xu, Baosheng Wang, Bo Yu et al.· IEEE Transactions on Informa...· 0 citations
Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories whose integrity cannot be assumed. Prior work on repository poisoning largely focuses on attacker-controlled injection and disguise, but developers also shape risk through everyday invocation choices: what task to delegate, how to phrase the request, and which skills or rules to supply. We term these user-side choices Prompt-Level Configurations (PLCs) and introduce CIPR (Coding In Poisoned Repos), the first benchmark that systematically varies PLCs in poisoned real-world repositories. CIPR comprises 1,920 instances across 20 repositories, four task types, three social-media-grounded prompt styles, and three skill/rule conditions, and measures attack success rate (ASR) and agent alert rate (AR) using automated runtime and trace-based oracles. Our evaluation reveals two key insights: (1) Vulnerability is highly context-dependent, with task type creating up to a 4.5-fold difference in ASR, with test-execution task forming a silent attack surface (high ASR, low AR). (2) Prompt expression shifts risk indirectly: underspecified prompts reduce ASR by truncating execution depth; noisy prompts exhibit a directional trend toward suppressing alerts by making malicious content less conspicuous. These findings highlight that coding agent vulnerability is not a static property, but a dynamic outcome shaped by everyday user configurations.
Fu-Kang Zhu, Binbin Zhao, Ruixiao Lin et al.· 0 citations