NecoFuzz: Effective Fuzzing of Nested Virtualization via Fuzz-Harness Virtual Machines

TL;DR

NecoFuzz is a novel fuzzing framework that effectively tests nested virtualization hypervisors by generating boundary-aware fuzz-harness VMs, uncovering new vulnerabilities and improving security coverage.

Contribution

It introduces a systematic approach to fuzz nested virtualization logic by synthesizing boundary-aware VMs guided by hardware specifications, a novel method in hypervisor fuzzing.

Findings

Achieved high code coverage on Intel VT-x and AMD-V hypervisors.

Discovered six previously unknown vulnerabilities, including two CVEs.

Demonstrated effectiveness of boundary-guided fuzzing in security testing.

Abstract

Nested virtualization is now widely supported by major cloud vendors, allowing users to leverage virtualization-based technologies in the cloud. However, supporting nested virtualization significantly increases host hypervisor complexity and introduces a new attack surface in cloud platforms. While many prior studies have explored hypervisor fuzzing, none has explicitly addressed nested virtualization due to the challenge of generating effective virtual machine (VM) instances with a vast state space as fuzzing inputs. We present NecoFuzz, the first fuzzing framework that systematically targets nested virtualization-specific logic in hypervisors. NecoFuzz synthesizes executable fuzz-harness VMs with internal states near the boundary between valid and invalid, guided by an approximate model of hardware-assisted virtualization specifications. Since vulnerabilities in nested virtualization often stem from incorrect handling of unexpected VM states, this specification-guided, boundary-oriented generation significantly improves coverage of security-critical code across different hypervisors. We implemented NecoFuzz on Intel VT-x and AMD-V by extending AFL++ to support fuzz-harness VMs. NecoFuzz achieved 84.7% and 74.2% code coverage for nested virtualization-specific code on Intel VT-x and AMD-V, respectively, and uncovered six previously unknown vulnerabilities across three hypervisors, including two assigned CVEs.