Open Source Summit + Embedded Linux Conference Europe 2020

With the rise of data-centric IoT and Edge Compute, hypervisors have become a key component for real-time assurance, workload consolidation, and management. Unlike traditional cloud infrastructure, hypervisors at the Edge face an extended threat model with a broader set of threats and requirements (e.g. determinism, data privacy, etc..). As a result, ensuring the security and functional correctness of critical elements in the Trusted Computing Base (TCB) is crucial for the overall edge node security and dependability. Dynamic security validation methods like "Fuzzing" have been highly successful in uncovering novel bugs with runtime impact. However, as of now, there are no effective tools for covering the complex and diverse nature of components in the modern virtualization software stack. In this presentation, we discuss state-of-art fuzzing approaches that fit into the virtualized edge ecosystem. In addition, we share a set of Best Known Methods (BKMs) and techniques to execute a comprehensive fuzzing campaign for components scattered across different software layers; starting from the hypervisor, kernel service modules, and up to the Device Model (DM) in userspace.