Looking for Remote Code Execution bugs in the Linux kernel

I wrote an article about fuzzing the Linux kernel network stack externally with syzkaller.

The article covers:

🧰 Introduction to syzkaller
💉 Using TUN/TAP for injecting packets into the kernel
🚚 Patching TUN/TAP for collecting coverage via KCOV
👽 Adding pseudo-syscalls for network fuzzing
🗄 Describing packet structure in syzlang
🏆 Showcases of found bugs

In the article, I put a focus on the presentation: highlighted syzlang code, made interactive snippets, added side notes that are actually on the side. I also implemented a dynamic table of contents (only visible on large screens).

The described work was done a few years ago, but I consider it still relevant. The recent trend of looking for remote Linux kernel exploits is quite exciting! I hope to see even more research in this area.