ASFuzz: Detecting Linux Kernel Asynchronous Concurrency Bugs via Asynchronous Shadow Fuzzing
Concurrency bugs arising from asynchronous-synchronous interactions pose a serious and underexplored threat to OS kernel security. Conventional detection methods often fail to capture the delayed triggering nature of asynchronous tasks and their semantic relationships with synchronous execution contexts, limiting their ability to detect such bugs. We propose two key insights: explicit dependency modeling between execution paths, and contingent triggering of asynchronous tasks during associated synchronous execution. Based on this, we develop ASFuzz, an asynchronous fuzzing system that builds a Shadow Dependency Graph to capture scheduling relations, context-matched resource relations, and operation types. Leveraging the Shadow Dependency Graph, ASFuzz employs a dual-mode architecture: a coverage-guided phase explores synchronous paths and collects legitimate asynchronous-triggering seeds, while a shadow execution phase generates legal syscall programs that naturally schedule related asynchronous tasks during relevant synchronous contexts. An adaptive scheduler coordinates the process, balancing broad state exploration and targeted interleaving stress. We evaluated ASFuzz on Linux kernel versions 6.6 to 6.15. The results demonstrate that ASFuzz successfully uncovered 14 previously unknown concurrency-related bugs, including 10 asynchronous concurrency bugs; 5 of the 14 bugs have been assigned CVE identifiers. These findings validate the effectiveness of our dual insights and highlight ASFuzz’s capability in exposing deep and subtle asynchronous concurrency bugs through dependency-driven and context-sensitive testing.