Date: Sat, 15 Jun 2019 11:49:03 -0400 From: Alex Gaynor <alex.gaynor@...il.com> To: oss-security@...ts.openwall.com Subject: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Hi everyone, OSS-Fuzz is Google's project to provide continious large-scale fuzzing. Since it launched in 2016, it's found just shy of 3000 things it counts as security bugs . I'm not a developer of OSS-Fuzz (at Google), but I've helped several projects integrate with it. You can see that it's had some amazing success across a variety of projects -- I've written previously to this list about the things I thought made it particularly effective working with ImageMagick and GraphicsMagick . Today I'd like to highlight what I see as a tremendous issue: very few of these security bugs ever has a CVE issued for it. This is probably due to a few factors, a) the relative difficulty of obtaining a CVE, b) the lack of a human reporter who is interested in obtaining one for "credit" purposes, c) the sheer number of bugs that we're talking about. CVEs are not important for their own sake. The true value is in all of the downstream processing that uses them as input: the Linux distributions that use them to figure out what fixes to backport, the docker security scanners that look for vulnerable code on the system, the corporate threat-intelligence feeds, etc. A test of a random ImageMagick vulnerability against Ubuntu Xenial shows that it, indeed, continues to reproduce. This is in addition to the >100 security bugs OSS-Fuzz found and publicly disclosed due to hitting their disclosure deadline, and which still have not been fixed . I haven't analyzed any of these vulnerabilities for exploitability, and I doubt anyone else has either. I do not have a solution to this problem. I wanted to raise awareness of it, in the hope that it would start a discussion which might come to a solution. Alex : Security bug is defined as roughly: heap/stack/global buffer overflow, heap use after free, heap double free, invalid free, stack use after scope, invalid typecast, other non-null segfaults, and a few other things. : https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=status%3AVerified+Type%3ABug-Security&colspec=ID+Type+Component+Status+Library+Reported+Owner+Summary+Modified&sort=-modified&groupby=&mode=grid&y=Proj&x=Security_Severity&cells=counts&nobtn=Update : https://alexgaynor.net/2019/feb/05/notes-fuzzing-imagemagick-graphicsmagick/ : https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=Type%3DBug-Security+status%3ANew+label%3ADeadline-exceeded&colspec=ID+Type+Component+Status+Library+Reported+Summary+Modified&sort=-modified&groupby=&mode=grid&y=Proj&x=--&cells=ids&nobtn=Update -- All that is necessary for evil to succeed is for good people to do nothing.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.