ReFuzz -- Structure Aware Fuzzing of Microsoft's Resilient File System (ReFS)

Abstract

The Resilient File System (ReFS) from Microsoft promises new features such as increased performance and resilience compared to the New Technology File System (NTFS). On the downside, the ReFS drivers are growing more extensive and more complex, increasing the attack surface of the Windows kernel. Attackers can often use security-critical bugs in file system drivers to escalate privileges by mounting a file system. In this work, we present ReFuzz, a structure-aware fuzzer that uses hardware-assisted code coverage to identify bugs in the ReFS driver. The ReFS file system offers several challenges to fuzzing because first, while ReFS is not documented, it exhaustively uses checksums. Second, the minimal size of a ReFS partition is 2GB, notably decreasing the performance of naive fuzzing approaches. We demonstrate the effectiveness of our fuzzing approach by finding 27 unique payloads that panic the Windows kernel when mounting or accessing ReFS partitions. Furthermore, we find 162 unique payloads that lead to a system hang-up. Microsoft confirmed those bugs and acknowledged ten unique issues which are security-critical, eight of them allowing remote code execution attacks and got assigned with a CVE number.

Mehr zum Titel

Titel	ReFuzz -- Structure Aware Fuzzing of Microsoft's Resilient File System (ReFS)
Medien	17th ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022)
Verfasser	Tobias Groß, Tobias Schleier, Prof. Dr. Tilo Müller
Seiten	S. 589-601
Veröffentlichungsdatum	30.05.2022
Zitation	Groß, Tobias; Schleier, Tobias; Müller, Tilo (2022): ReFuzz -- Structure Aware Fuzzing of Microsoft's Resilient File System (ReFS). 17th ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS 2022), S. 589-601.