{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/kernelgpt-enhanced-kernel-fuzzing-via-large","title":"KernelGPT: Enhanced Kernel Fuzzing via Large Language Models","arxiv_id":"2401.00563","date":"2023-12-31","proceeding":null,"authors":["Chenyuan Yang","Zijie Zhao","Lingming Zhang"],"abstract":"Bugs in operating system kernels can affect billions of devices and users all over the world. As a result, a large body of research has been focused on kernel fuzzing, i.e., automatically generating syscall (system call) sequences to detect potential kernel bugs or vulnerabilities. Kernel fuzzing aims to generate valid syscall sequences guided by syscall specifications that define both the syntax and semantics of syscalls. While there has been existing work trying to automate syscall specification generation, this remains largely manual work, and a large number of important syscalls are still uncovered. In this paper, we propose KernelGPT, the first approach to automatically synthesizing syscall specifications via Large Language Models (LLMs) for enhanced kernel fuzzing. Our key insight is that LLMs have seen massive kernel code, documentation, and use cases during pre-training, and thus can automatically distill the necessary information for making valid syscalls. More specifically, KernelGPT leverages an iterative approach to automatically infer the specifications, and further debug and repair them based on the validation feedback. Our results demonstrate that KernelGPT can generate more new and valid specifications and achieve higher coverage than state-of-the-art techniques. So far, by using newly generated specifications, KernelGPT has already detected 24 new unique bugs in Linux kernel, with 12 fixed and 11 assigned with CVE numbers. Moreover, a number of specifications generated by KernelGPT have already been merged into the kernel fuzzer Syzkaller, following the request from its development team.","url_abs":"https://arxiv.org/abs/2401.00563v3","url_pdf":"https://arxiv.org/pdf/2401.00563v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"kernelgpt-enhanced-kernel-fuzzing-via-large","repo_url":"https://github.com/ise-uiuc/kernelgpt","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":null,"task_name":"valid"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2401.00563","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2401.00563"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ise-uiuc/kernelgpt","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran":9,"unverified":8},"by_repo_kind":{"official":{"samples":17,"ran":9,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"cafe4e687de900be","entry":"extract_code_block","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/llm_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/llm_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"cafe4e687de900be"}},{"code_sha256_prefix":"0d9c3fed9939c48f","entry":"extract_ioctl_function_name","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/analyzer/process_output.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/analyzer/process_output.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0d9c3fed9939c48f"}},{"code_sha256_prefix":"90a14820ad038a07","entry":"find_name","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/find_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/find_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"90a14820ad038a07"}},{"code_sha256_prefix":"b361d3edf79bea45","entry":"get_ops_type","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/gen_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/gen_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b361d3edf79bea45"}},{"code_sha256_prefix":"537535ef80a7376f","entry":"get_path_name","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/gen_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/gen_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"537535ef80a7376f"}},{"code_sha256_prefix":"1765f746170fcd88","entry":"get_unique_name","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/gen_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/gen_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"1765f746170fcd88"}},{"code_sha256_prefix":"24ef7eee66b71029","entry":"is_primitive_type","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/output_spec.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/output_spec.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"24ef7eee66b71029"}},{"code_sha256_prefix":"781825a17023e586","entry":"load_data","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/find_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/find_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"781825a17023e586"}},{"code_sha256_prefix":"d02df34683e889ea","entry":"path_similarity","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/analyzer/process_output.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/analyzer/process_output.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d02df34683e889ea"}},{"code_sha256_prefix":"5b30bbd5da2cbcae","entry":"create_shared_linux_with_config","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-eval/run-specs.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-eval/run-specs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5b30bbd5da2cbcae"}},{"code_sha256_prefix":"2636b92babc3ddd6","entry":"debug_output","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/analyzer/process_output.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/analyzer/process_output.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"2636b92babc3ddd6"}},{"code_sha256_prefix":"b1230f5e4e37c060","entry":"find_type","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/find_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/find_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"b1230f5e4e37c060"}},{"code_sha256_prefix":"bf9453de6b993795","entry":"get_open_str","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/output_spec.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/output_spec.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"bf9453de6b993795"}},{"code_sha256_prefix":"34ce1ce60b0c72c6","entry":"get_shared_linux_with_config","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-eval/run-specs.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-eval/run-specs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"34ce1ce60b0c72c6"}},{"code_sha256_prefix":"c3570dbd1142e799","entry":"prepare_linux","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-eval/run-specs.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-eval/run-specs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"c3570dbd1142e799"}},{"code_sha256_prefix":"5506ea8f95924923","entry":"query_ollm","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/llm_utils.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/llm_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5506ea8f95924923"}},{"code_sha256_prefix":"4b04b35a66f40278","entry":"run_eval","repo":"ise-uiuc/kernelgpt","repo_kind":"official","path":"spec-gen/eval_spec.py","file_url":"https://github.com/ise-uiuc/kernelgpt/blob/HEAD/spec-gen/eval_spec.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4b04b35a66f40278"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}