📄 Presented at EuroSys 2026

Reima Ishii (1st-year Ph.D. student) presented our paper, NecoFuzz: Effective Fuzzing of Nested Virtualization via Fuzz-Harness Virtual Machines, at the European Conference on Computer Systems (EuroSys 2026), held in Edinburgh, UK, in April 2026.

The paper presents NecoFuzz, a fuzzing framework for efficiently testing hardware-assisted virtualization emulation code to uncover bugs and vulnerabilities in nested virtualization implementations.

To address the large virtual machine state space, complex initialization procedures, and diverse virtual CPU configurations, NecoFuzz constructs a minimal bootable virtual machine as a fuzzing harness. It efficiently explores virtual machine states near the valid/invalid boundary defined by hardware virtualization specifications, enabling effective testing of nested virtualization emulation code in virtual machine monitors.

Our implementation for Intel VT-x and AMD-V discovered multiple bugs and vulnerabilities in KVM, Xen, and VirtualBox. Two of them were assigned CVE identifiers: CVE-2023-30456 and CVE-2024-21106.

This research was conducted in collaboration with Takaaki Fukai from the National Institute of Advanced Industrial Science and Technology (AIST).

EuroSys Data

• Google Scholar Metrics: H5-index 48
• CORE Rank: A (CORE 2023)