[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 8 Dec 2020 17:18:04 -0500
From: Robert Watson <robertcwatson1@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Bugs found by Cryptofuzz - some missing CVEs or
too low impact for CVE?
Question from a retired programmer but security novice... Since fuzzing is
used to find bugs in other programs, doesn't it need to be held to a bit
higher standard in order to maintain credibility?
On Tue, Dec 8, 2020, 16:12 Eric Biggers <ebiggers@...nel.org> wrote:
> On Tue, Dec 08, 2020 at 08:01:14PM +0100, yersinia wrote:
> > At this link, multiple security bugs of various kinds are highlighted in
> > very widespread basic cryptographic applications, which have then been
> > corrected. I haven't done a deep analysis on all of them but I haven't
> > found any associated CVEs of some of them. Do I have to assume that they
> > weren't all that important or that the process of reporting them was
> > missing? Thanks
> >
> > https://github.com/guidovranken/cryptofuzz
>
> Fuzzing can easily find large numbers of bugs, and it's usually unclear
> what the
> security impact of them is. So if people want CVEs, someone has to
> actually put
> the effort into analyzing each bug and (if applicable) filing for a CVE.
> Presumably just no one has done that for the above bugs.
>
> Something similar happened when I added fuzz tests to the Linux kernel's
> crypto
> API last year. In less than a year they had resulted in over 100 bug
> fixes.
> Most didn't *seem* too concerning, e.g. most were bugs in crypto drivers
> that
> seemed to be rarely used, or crypto algorithms that seemed to be rarely
> used, or
> edge cases in the crypto API that seemed to be rarely or never encountered.
>
> The bugs in userspace libraries found by cryptofuzz look somewhat
> similar. They
> include some of the same kinds of bugs, like mishandling zero-length
> inputs,
> mishandling data passed in specific chunk sizes, or bugs in weird
> algorithms.
>
> However, in both cases it isn't possible to be certain of the impact and
> applicability for a CVE of each bug without analyzing each bug in detail,
> which
> would be very time-consuming, and in general it's no one's job to do that.
>
> Likewise, syzkaller has found thousands of Linux kernel bugs and most
> haven't
> had CVEs filed.
>
> - Eric
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
