SEMSAN: Finding the 0-Days You Can't Crash Into

Traditional fuzzers and sanitizers catch memory corruption bugs, but what about those that never cause a crash? Path traversals, argument injections, and container escapes execute cleanly, leave no core dump, and sail right past ASan and UBSan. We built SEMSAN (SemanticSanitizer) to hunt exactly these. This project was accepted and is to be presented at USENIX WOOT 2026. SEMSAN hooks into the Linux kernel via eBPF and lets you define custom runtime invariants. Rules like "this process should never write outside its container rootfs" or "no git subprocess should receive a flag it wasn't given." When a violation fires, the fuzzer sees a crash. No source code required, no kernel patches, negligible overhead. We'll walk through five 0-days we found with it. An argument injection in Gitweb that truncates arbitrary files. A TOCTOU privilege escalation in Docker. Another argument injection in the SSH-based git forge Soft-Serve (CVE-2025-58355, CVSS 7.7). A 21-year-old path traversal in ViewVC (CVE-2025-54141, CVSS 7.5) that bypasses repo authorization. And a chained remote code execution in Grafana that earned a $10,000 bounty. None of these triggered a single crash or alarm under standard tooling. SEMSAN found them all.