syzkaller - Coverage-Guided Kernel Fuzzer Cheatsheet
syzkaller is Google’s unsupervised, coverage-guided kernel fuzzer. It generates sequences of syscalls described by a declarative language (syzlang), executes them inside VMs, uses kernel coverage (KCOV) to steer mutation toward unexplored code, and detects crashes via kernel sanitizers. It runs continuously without human input and has found thousands of Linux kernel bugs — the syzbot continuous-fuzzing system is built on it. It also supports other kernels including BSDs, Fuchsia, and Windows.
Fuzzing crashes kernels by design. Always run inside disposable VMs, never on a machine you care about.
Prerequisites
| Requirement | Note |
|---|
| Go toolchain | To build syzkaller |
| Kernel source | Built with KCOV, KASAN, and debug info |
| VM support | QEMU/KVM, GCE, or physical boards |
| Disk image | A minimal rootfs for the guest |
Building
git clone https://github.com/google/syzkaller
cd syzkaller && make
| Binary | Role |
|---|
syz-manager | Orchestrates VMs, corpus, and reporting |
syz-fuzzer | Runs inside the guest, generates programs |
syz-executor | Executes syscall programs in the guest |
syz-repro | Minimizes a crash into a reproducer |
syz-prog2c | Converts a syz program to C |
Required Kernel Config
| Option | Purpose |
|---|
CONFIG_KCOV=y | Coverage feedback (essential) |
CONFIG_KASAN=y | Memory-error detection |
CONFIG_DEBUG_INFO=y | Symbolized reports |
CONFIG_KASAN_INLINE=y | Faster KASAN |
CONFIG_FAULT_INJECTION=y | Explore error paths |
CONFIG_DEBUG_KMEMLEAK=y | Leak detection (optional) |
Without KCOV the fuzzer is blind — coverage feedback is what makes it effective rather than random.
Manager Configuration
{
"target": "linux/amd64",
"http": "127.0.0.1:56741",
"workdir": "/home/user/syzkaller/workdir",
"kernel_obj": "/home/user/linux",
"image": "/home/user/image/bullseye.img",
"sshkey": "/home/user/image/bullseye.id_rsa",
"syzkaller": "/home/user/syzkaller",
"procs": 8,
"type": "qemu",
"vm": { "count": 4, "kernel": "/home/user/linux/arch/x86/boot/bzImage", "cpu": 2, "mem": 2048 }
}
./bin/syz-manager -config my.cfg
| Field | Purpose |
|---|
target | OS/arch under test |
kernel_obj | Kernel build dir (for symbolization) |
image / sshkey | Guest rootfs and access |
procs | Parallel fuzzing processes per VM |
vm.count | Number of concurrent VMs |
http | Web dashboard address |
The Web Dashboard
| View | Shows |
|---|
| Crashes | Unique crash titles + counts |
| Corpus | Programs contributing coverage |
| Coverage | Which kernel files/lines are reached |
| Stats | Exec rate, VM health |
Coverage is the number to watch: if it plateaus, the fuzzer has exhausted what your syscall descriptions can reach.
syzlang (Syscall Descriptions)
# Simplified example: describe a syscall's argument structure
open(file ptr[in, filename], flags flags[open_flags], mode flags[open_mode]) fd
read(fd fd, buf buffer[out], count len[buf])
Good descriptions are what let the fuzzer build valid-enough programs to reach deep code. Extending sys/linux/*.txt for an under-tested subsystem is often the highest-value contribution.
Reproducing Crashes
| Command | Purpose |
|---|
| Automatic | The manager runs syz-repro on new crashes |
syz-repro -config my.cfg crash.log | Manually minimize |
syz-prog2c -prog repro.syz | Emit a standalone C reproducer |
| C reproducer | What you attach to a bug report |
syzkaller vs Other Fuzzers
| Aspect | syzkaller | AFL++ | libFuzzer |
|---|
| Target | OS kernels (syscalls) | Userspace binaries | In-process libraries |
| Input | Syscall programs | Files/stdin | Byte buffers |
| Feedback | KCOV | Edge coverage | SanitizerCoverage |
| Best for | Kernel bug hunting | General binary fuzzing | Library APIs |
For userspace targets use AFL++ or honggfuzz; syzkaller is purpose-built for the kernel syscall boundary.
Resources
