IRIS: a Record and Replay Framework to Enable Hardware-assisted Virtualization Fuzzing. (arXiv:2303.12817v1 [cs.CR])

Nowadays, industries are looking into virtualization as an effective means to
build safe applications, thanks to the isolation it can provide among virtual
machines (VMs) running on the same hardware. In this context, a fundamental
issue is understanding to what extent the isolation is guaranteed, despite
possible (or induced) problems in the virtualization mechanisms. Uncovering
such isolation issues is still an open challenge, especially for
hardware-assisted virtualization, since the search space should include all the
possible VM states (and the linked hypervisor state), which is prohibitive. In
this paper, we propose IRIS, a framework to record (learn) sequences of inputs
(i.e., VM seeds) from the real guest execution (e.g., OS boot), replay them
as-is to reach valid and complex VM states, and finally use them as valid seed
to be mutated for enabling fuzzing solutions for hardware-assisted hypervisors.
We demonstrate the accuracy and efficiency of IRIS in automatically reproducing
valid VM behaviors, with no need to execute guest workloads. We also provide a
proof-of-concept fuzzer, based on the proposed architecture, showing its
potential on the Xen hypervisor.