Jiacheng Xu

The Operating System (OS) kernel is foundational in modern computing, especially with the proliferation of diverse computing devices. However, its development comes with vulnerabilities that can lead to severe security breaches. Kernel fuzzing, a technique used to uncover these vulnerabilities, poses distinct challenges when compared to user-space fuzzing. These include the complexity of configuring the testing environment and addressing the statefulness inherent to both the kernel and the fuzzing process. Despite the significant interest from the community, a comprehensive understanding of kernel fuzzing remains lacking, hindering further progress in the field. In this paper, we present the first systematic study focused specifically on OS kernel fuzzing. We begin by outlining the unique challenges of kernel fuzzing, which distinguish it from those in user space. Following this, we summarize the progress of 107 academic studies from top-tier venues between 2017 and 2025. To structure this analysis, we introduce a stage-based fuzzing model and a novel fuzzing taxonomy that highlights nine core functionalities unique to kernel fuzzing. Each of these functionalities is examined in conjunction with the methodological approaches employed to address them. Finally, we identify remaining gaps in addressing challenges and outline promising directions to guide forthcoming research in kernel security.

Currently, the development of IoT firmware heavily depends on third-party components (TPCs) to improve development efficiency. Nevertheless, TPCs are not secure, and the vulnerabilities in TPCs will influence the security of IoT firmware. Existing works pay less attention to the vulnerabilities caused by TPCs, and we still lack a comprehensive understanding of the security impact of TPC vulnerability against firmware. To fill in the knowledge gap, we design and implement FirmSec , which leverages syntactical features and control-flow graph features to detect the TPCs in firmware, and then recognizes the corresponding vulnerabilities. Based on FirmSec , we present the first large-scale analysis of the security risks raised by TPCs on 34,136 firmware images. We successfully detect 584 TPCs and identify 128,757 vulnerabilities caused by 429 CVEs. Our in-depth analysis reveals the diversity of security risks in firmware and discovers some well-known vulnerabilities are still rooted in firmware. Besides, we explore the geographical distribution of vulnerable devices and confirm that the security situation of devices in different regions varies. Our analysis also indicates that vulnerabilities caused by TPCs in firmware keep growing with the boom of the IoT ecosystem. Further analysis shows 2,478 commercial firmware images have potentially violated GPL/AGPL licensing terms.

The heavy fermion ferromagnet CeRh₆Ge₄ is the first example of a clean stoichiometric system where the ferromagnetic transition can be continuously suppressed by hydrostatic pressure to a quantum critical point. In order to reveal the outcome when the magnetic lattice of CeRh₆Ge₄ is diluted with non-magnetic atoms, this study reports comprehensive measurements of the physical properties of both single crystal and polycrystalline samples of La _x Ce_1–x Rh₆Ge₄. With increasing x, the Curie temperature decreases, and no transition is observed for x > 0.25, while the system evolves from exhibiting coherent Kondo lattice behaviors at low x to the Kondo impurity scenario at large x. Moreover, non-Fermi liquid behavior is observed over a wide doping range, which agrees well with the disordered Kondo model for 0.52 ≤ x ≤ 0.66, while strange metal behavior is revealed in the vicinity of x _c = 0.26.