NecoFuzz: Effective Fuzzing of Nested Virtualization via Fuzz-Harness Virtual Machines
Reima Ishii, Takaaki Fukai, Takahiro Shinagawa

TL;DR
NecoFuzz is a novel fuzzing framework that effectively tests nested virtualization hypervisors by generating boundary-aware fuzz-harness VMs, uncovering new vulnerabilities and improving security coverage.
Contribution
It introduces a systematic approach to fuzz nested virtualization logic by synthesizing boundary-aware VMs guided by hardware specifications, a novel method in hypervisor fuzzing.
Findings
Achieved high code coverage on Intel VT-x and AMD-V hypervisors.
Discovered six previously unknown vulnerabilities, including two CVEs.
Demonstrated effectiveness of boundary-guided fuzzing in security testing.
Abstract
Nested virtualization is now widely supported by major cloud vendors, allowing users to leverage virtualization-based technologies in the cloud. However, supporting nested virtualization significantly increases host hypervisor complexity and introduces a new attack surface in cloud platforms. While many prior studies have explored hypervisor fuzzing, none has explicitly addressed nested virtualization due to the challenge of generating effective virtual machine (VM) instances with a vast state space as fuzzing inputs. We present NecoFuzz, the first fuzzing framework that systematically targets nested virtualization-specific logic in hypervisors. NecoFuzz synthesizes executable fuzz-harness VMs with internal states near the boundary between valid and invalid, guided by an approximate model of hardware-assisted virtualization specifications. Since vulnerabilities in nested…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Physical Unclonable Functions (PUFs) and Hardware Security · Radiation Effects in Electronics
