Janus
A state-of-the-art file system fuzzer for Linux that explores both image and syscall input spaces simultaneously to find memory corruptions.
What is Janus?
Janus is a file system fuzzer for Linux that discovers memory corruptions in in-kernel file systems by exploring both disk images and system call sequences simultaneously. It addresses the challenge of comprehensive file system testing by treating image structure and file operations as a two-dimensional input space. The tool has found approximately 100 unique crashes with 32 CVEs assigned in mainstream file systems.
Security researchers, kernel developers, and file system engineers who need to test the robustness and security of Linux file system implementations. It's particularly valuable for those conducting systematic security assessments of storage systems.
Janus offers unique two-dimensional input space exploration that traditional fuzzers lack, enabling discovery of complex bugs that require specific combinations of image states and file operations. Its integration with LKL provides a lightweight, reproducible testing environment without requiring full virtual machines.
Overview
Janus: a state-of-the-art file system fuzzer on Linux
Use Cases
Best For
- Finding memory corruption vulnerabilities in Linux file system implementations
- Security researchers conducting systematic file system security assessments
- Kernel developers testing new file system features or patches
- Quality assurance teams performing deep file system testing
- Academic research on file system robustness and fuzzing techniques
- Discovering CVEs in mainstream file systems like ext4, btrfs, and F2FS
Not Ideal For
- Fuzzing user-space applications or non-file system kernel modules
- Projects requiring quick deployment with minimal setup and configuration
- Testing file systems in full virtual machine or hardware-based production environments
- Teams without deep kernel debugging expertise or resources to analyze in-kernel crashes
Pros & Cons
Pros
Simultaneously explores disk image mutations and system call sequences, enabling discovery of complex bugs that traditional fuzzers miss, as evidenced by finding 100+ unique crashes.
Has led to 32 CVEs assigned in mainstream file systems, demonstrating real-world effectiveness in identifying vulnerabilities.
Targets the Linux Kernel Library instead of full VMs, reducing overhead and allowing faster fuzzing cycles, as outlined in the implementation.
Supports running multiple Janus instances collaboratively for distributed fuzzing, speeding up bug discovery per the run instructions.
Cons
Only supports ext4, btrfs, and F2FS currently, with no built-in support for other file systems like XFS or NTFS, limiting its scope.
Requires compiling multiple components (ff-gcc, core, lkl, image parsers) with dependencies on Ubuntu 16.04 and older compilers, making deployment non-trivial and error-prone.
Documentation and tested environment are based on Ubuntu 16.04 and clang 6.0.0, which may not be compatible with modern systems without significant adjustments.
Frequently Asked Questions
Related Projects
syzkallersyzkaller is an unsupervised coverage-guided kernel fuzzer
kAFLCode for the USENIX 2017 paper: kAFL: Hardware-Assisted Feedback Fuzzing for OS Kernels
DIFUZEFuzzer for Linux Kernel Drivers
RazzerA Kernel fuzzer focusing on race bugs
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.