NecoFuzz: Effective Fuzzing of Nested Virtualization via Fuzz-Harness Virtual Machines

2025-12-09

AI Summary

Nested virtualization is widely deployed in cloud platforms, yet its added complexity and novel attack surfaces demand systematic security assessment. This paper presents the first fuzzing framework targeting hypervisor-resident nested virtualization–specific logic. We propose a fuzz-harness virtual machine synthesis method grounded in approximate hardware virtualization specification modeling and boundary-state–guided instrumentation to precisely trigger defects in abnormal VM state handling. By extending AFL++ to generate VM-level inputs and tightly integrating fine-grained modeling of Intel VT-x and AMD-V hardware features with execution feedback, our approach achieves 84.7% and 74.2% coverage of nested virtualization–specific code on Intel and AMD platforms, respectively. It uncovers six previously unknown vulnerabilities—including two assigned CVEs—demonstrating substantial advancement in the security validation capability for nested virtualization.

Technology Category

• Machine Learning: Hardware-aware ML
• Computer Vision: Adversarial Attacks & Robustness
• Application Domains: Security

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Virtualization and resource management in Web systems and infrastructures
• Security and Privacy: Large-scale security measurements
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

Nested virtualization is now widely supported by major cloud vendors, allowing users to leverage virtualization-based technologies in the cloud. However, supporting nested virtualization significantly increases host hypervisor complexity and introduces a new attack surface in cloud platforms. While many prior studies have explored hypervisor fuzzing, none has explicitly addressed nested virtualization due to the challenge of generating effective virtual machine (VM) instances with a vast state space as fuzzing inputs. We present NecoFuzz, the first fuzzing framework that systematically targets nested virtualization-specific logic in hypervisors. NecoFuzz synthesizes executable fuzz-harness VMs with internal states near the boundary between valid and invalid, guided by an approximate model of hardware-assisted virtualization specifications. Since vulnerabilities in nested virtualization often stem from incorrect handling of unexpected VM states, this specification-guided, boundary-oriented generation significantly improves coverage of security-critical code across different hypervisors. We implemented NecoFuzz on Intel VT-x and AMD-V by extending AFL++ to support fuzz-harness VMs. NecoFuzz achieved 84.7% and 74.2% code coverage for nested virtualization-specific code on Intel VT-x and AMD-V, respectively, and uncovered six previously unknown vulnerabilities across three hypervisors, including two assigned CVEs.

Problem

• Fuzzing nested virtualization in hypervisors for vulnerabilities
• Generating effective VM instances as fuzzing inputs
• Improving coverage of security-critical nested virtualization code

Innovation

• Synthesizes boundary-state fuzz-harness VMs guided by virtualization specifications
• Extends AFL++ to support fuzz-harness VMs on Intel VT-x and AMD-V
• Targets nested virtualization-specific logic in hypervisors for vulnerability discovery