A hardware-assisted feedback fuzzing framework for discovering vulnerabilities in x86-64 OS kernels.
kAFL is an open-source fuzzing framework that discovers security vulnerabilities in operating system kernels. It uses Intel Processor Trace hardware features to perform coverage-guided fuzzing at high speeds across Linux, macOS, and Windows environments. The framework enables efficient testing of kernel components through rapid VM snapshot restoration.
Security researchers and kernel developers focused on vulnerability discovery and hardening OS security. It's particularly valuable for those analyzing x86-64 kernel subsystems and filesystem drivers.
kAFL offers hardware-accelerated fuzzing with minimal overhead compared to software-instrumented alternatives, enabling larger-scale testing campaigns. Its proven ability to find critical CVEs in production kernels demonstrates practical effectiveness where other tools struggle.
Code for the USENIX 2017 paper: kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Intel Processor Trace for coverage-guided fuzzing without software instrumentation, enabling blazing-fast execution speeds as described in the key features.
Fuzzes Linux, macOS, and Windows kernels via QEMU virtualization, allowing broad OS coverage for security research.
Implements snapshot-based restoration to minimize overhead between test cases, crucial for performant large-scale fuzzing campaigns.
Has a documented track record of finding critical CVEs in Linux and macOS filesystems, demonstrating real-world effectiveness in the trophies section.
The README admits that full documentation is currently missing, which can hinder onboarding, troubleshooting, and advanced usage.
Agents for macOS and Windows are not fully implemented except for test drivers, restricting out-of-the-box functionality for those platforms.
Requires Intel processors with PT support, excluding AMD systems and older hardware, which limits deployment options.
Involves multi-step VM creation, snapshot management, and configuration editing as shown in the setup guide, making it error-prone and time-consuming.