Date: Tue, 8 Dec 2020 12:31:37 -0800 From: Eric Biggers <ebiggers@...nel.org> To: yersinia <yersinia.spiros@...il.com> Cc: oss-security@...ts.openwall.com Subject: Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? On Tue, Dec 08, 2020 at 08:01:14PM +0100, yersinia wrote: > At this link, multiple security bugs of various kinds are highlighted in > very widespread basic cryptographic applications, which have then been > corrected. I haven't done a deep analysis on all of them but I haven't > found any associated CVEs of some of them. Do I have to assume that they > weren't all that important or that the process of reporting them was > missing? Thanks > > https://github.com/guidovranken/cryptofuzz Fuzzing can easily find large numbers of bugs, and it's usually unclear what the security impact of them is. So if people want CVEs, someone has to actually put the effort into analyzing each bug and (if applicable) filing for a CVE. Presumably just no one has done that for the above bugs. Something similar happened when I added fuzz tests to the Linux kernel's crypto API last year. In less than a year they had resulted in over 100 bug fixes. Most didn't *seem* too concerning, e.g. most were bugs in crypto drivers that seemed to be rarely used, or crypto algorithms that seemed to be rarely used, or edge cases in the crypto API that seemed to be rarely or never encountered. The bugs in userspace libraries found by cryptofuzz look somewhat similar. They include some of the same kinds of bugs, like mishandling zero-length inputs, mishandling data passed in specific chunk sizes, or bugs in weird algorithms. However, in both cases it isn't possible to be certain of the impact and applicability for a CVE of each bug without analyzing each bug in detail, which would be very time-consuming, and in general it's no one's job to do that. Likewise, syzkaller has found thousands of Linux kernel bugs and most haven't had CVEs filed. - Eric
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.