{"id":"https://openalex.org/W7155539435","doi":"https://doi.org/10.1145/3767295.3803624","title":"LifeFuzz: Lifecycle-Guided Fuzzing for Windows Driver Cross-Handler Vulnerabilities","display_name":"LifeFuzz: Lifecycle-Guided Fuzzing for Windows Driver Cross-Handler Vulnerabilities","publication_year":2026,"publication_date":"2026-04-24","ids":{"openalex":"https://openalex.org/W7155539435","doi":"https://doi.org/10.1145/3767295.3803624"},"language":null,"primary_location":{"id":"doi:10.1145/3767295.3803624","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3767295.3803624","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 21st European Conference on Computer Systems","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3767295.3803624","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5037970349","display_name":"Chendong Yu","orcid":null},"institutions":[{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chendong Yu","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0008-6632-3482","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068561556","display_name":"Yuekang Li","orcid":"https://orcid.org/0000-0003-4382-0757"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]},{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["AU","CN"],"is_corresponding":false,"raw_author_name":"Yuekang Li","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China","University of New South Wales, Sydney, Australia"],"raw_orcid":"https://orcid.org/0000-0003-4382-0757","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]},{"raw_affiliation_string":"University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100604658","display_name":"Yang Xiao","orcid":"https://orcid.org/0009-0005-8009-2252"},"institutions":[{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Xiao","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-8009-2252","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068388413","display_name":"Jie Lu","orcid":"https://orcid.org/0000-0002-4162-0404"},"institutions":[{"id":"https://openalex.org/I4210090176","display_name":"Institute of Computing Technology","ror":"https://ror.org/0090r4d87","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210090176"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jie Lu","raw_affiliation_strings":["Institute of Computing Technology, CAS, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-4162-0404","affiliations":[{"raw_affiliation_string":"Institute of Computing Technology, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210090176"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037974123","display_name":"Yeting Li","orcid":"https://orcid.org/0000-0003-0991-4231"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]},{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["AU","CN"],"is_corresponding":false,"raw_author_name":"Yeting Li","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China","University of New South Wales, Sydney, Australia"],"raw_orcid":"https://orcid.org/0000-0003-0991-4231","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]},{"raw_affiliation_string":"University of New South Wales, Sydney, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093906176","display_name":"Defang Bo","orcid":null},"institutions":[{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Defang Bo","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-3830-723X","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5134563853","display_name":"Wei Huo","orcid":"https://orcid.org/0009-0000-7121-1196"},"institutions":[{"id":"https://openalex.org/I37448385","display_name":"China People's Public Security University","ror":"https://ror.org/05twya590","country_code":"CN","type":"education","lineage":["https://openalex.org/I37448385"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wei Huo","raw_affiliation_strings":["Institute of Information Engineering, CAS, Beijing, China","School of Cyber Security, UCAS, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-7121-1196","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, Beijing, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I37448385"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2022","last_page":"2036"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.45500001311302185,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.45500001311302185,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.10670000314712524,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.07800000160932541,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.5763000249862671},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.29339998960494995},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.2773999869823456},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.26339998841285706},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.24959999322891235}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.5763000249862671},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5724999904632568},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44620001316070557},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.29339998960494995},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2773999869823456},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2554999887943268},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.24959999322891235},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.23759999871253967},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.23250000178813934}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3767295.3803624","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3767295.3803624","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 21st European Conference on Computer Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3767295.3803624","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3767295.3803624","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 21st European Conference on Computer Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Third-party":[0],"Windows":[1,114],"drivers":[2],"expose":[3],"a":[4,67],"critical":[5],"attack":[6],"surface.":[7],"However,":[8],"vulnerabilities":[9,136,149],"that":[10,71,89],"require":[11,150],"cross-handler":[12,123,135,151,156],"I/O":[13],"Control":[14],"(IOCTL)":[15],"sequences":[16],"remain":[17],"hard":[18],"to":[19,27,75],"find,":[20],"despite":[21],"their":[22],"prevalence,":[23],"and":[24,39,93,139],"often":[25,46],"lead":[26],"privilege":[28],"escalation.":[29],"Static":[30],"analysis":[31],"suffers":[32],"from":[33],"high":[34],"false":[35],"positives,":[36],"path":[37],"explosion,":[38],"complex":[40],"resource":[41],"modeling.":[42],"Meanwhile,":[43],"dynamic":[44],"fuzzers":[45],"exercise":[47],"handlers":[48],"in":[49],"isolation":[50],"or":[51],"combine":[52],"them":[53,96],"randomly,":[54],"leaving":[55],"implicit":[56],"state":[57],"dependencies":[58],"unchecked.":[59],"To":[60],"address":[61],"the":[62],"gap,":[63],"we":[64],"present":[65],"LifeFuzz,":[66],"lifecycle-guided":[68],"fuzzing":[69,157],"framework":[70],"models":[72],"global-variable":[73],"lifecycles":[74],"construct":[76],"dependency-respecting":[77],"IOCTL":[78],"sequences.":[79,99],"Specifically,":[80],"it":[81,131],"identifies":[82],"variable":[83],"operations":[84],"across":[85],"handlers,":[86],"preserves":[87],"seeds":[88],"affect":[90],"driver":[91,159],"state,":[92],"then":[94],"combines":[95],"into":[97],"meaningful":[98],"Consequently,":[100],"LifeFuzz":[101,111],"explores":[102],"deep":[103],"paths":[104],"unreachable":[105],"for":[106,158],"existing":[107],"fuzzers.":[108],"We":[109],"evaluate":[110],"on":[112],"26":[113],"WDM":[115],"drivers.":[116],"It":[117],"discovers":[118],"86":[119],"vulnerabilities,":[120],"including":[121],"32":[122],"cases,":[124],"with":[125],"six":[126],"assigned":[127],"CVE":[128],"IDs.":[129],"Moreover,":[130],"finds":[132],"357%":[133],"more":[134],"than":[137],"msFuzz":[138],"achieves":[140],"19.2%":[141],"higher":[142],"average":[143],"coverage.":[144],"Overall,":[145],"37%":[146],"of":[147],"discovered":[148],"interactions,":[152],"thereby":[153],"validating":[154],"lifecycle-aware,":[155],"security.":[160]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-04-25T00:00:00"}