Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/
Vock: Mapping Kernel Attack Surface With Zero-Configuration Coverage - Yunseong Kim, Ericsson Software Technology
There is no practical tool that maps userspace programs to the kernel code they exercise. strace shows syscall names but not kernel internals. KCOV requires kernel recompilation. perf is general-purpose and not designed for per-program kernel coverage.
vock fills this gap. It takes any userspace program and outputs the exact kernel functions and branches that program reaches.
Two modes:
(1) HW mode uses Intel PT or AMD LBR via perf_event_open() — works on any generic kernel without kcov. The PT decoder walks TNT bits against vmlinux to reconstruct full branch-level coverage.
(2) KCOV mode uses kernel instrumentation with per-process tracking across fork() and pthread_create().
Use cases: measure kernel vulnerability exposure per application, identify which kernel subsystems need hardening for a given workload, and narrow down the syscall space for targeted fuzzing — instead of fuzzing all 300+ syscalls, fuzz only the paths the target program actually reaches.
Vock is an acronym (and exact anagram) of Kcov.
Vock: Mapping Kernel Attack Surface With Zero-Configuration Coverage - Yunseong Kim, Ericsson Software Technology
There is no practical tool that maps userspace programs to the kernel code they exercise. strace shows syscall names but not kernel internals. KCOV requires kernel recompilation. perf is general-purpose and not designed for per-program kernel coverage.
vock fills this gap. It takes any userspace program and outputs the exact kernel functions and branches that program reaches.
Two modes:
(1) HW mode uses Intel PT or AMD LBR via perf_event_open() — works on any generic kernel without kcov. The PT decoder walks TNT bits against vmlinux to reconstruct full branch-level coverage.
(2) KCOV mode uses kernel instrumentation with per-process tracking across fork() and pthread_create().
Use cases: measure kernel vulnerability exposure per application, identify which kernel subsystems need hardening for a given workload, and narrow down the syscall space for targeted fuzzing — instead of fuzzing all 300+ syscalls, fuzz only the paths the target program actually reaches.
Vock is an acronym (and exact anagram) of Kcov.