[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1906241142430.23351@scrappy.simplesystems.org>
Date: Mon, 24 Jun 2019 11:44:31 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
OSS-Fuzz
On Mon, 24 Jun 2019, Alexander Potapenko wrote:
>>
>> Most oss-fuzz issue detections are not CVE worthy. For example, a
>> one-byte read "heap overflow" is not likely to cause any actual harm
>> but oss-fuzz would classify it as "heap overflow".
> There's enough information in the report though to assign the severity
> score depending on the access size, its type (read or write) the call
> stack etc.
> OSS-Fuzz deliberately doesn't do that now, but such scoring can be
> done to prune the list of potential CVE candidates.
Oss-fuzz does not take into account the important criteria which is
the actual underlying size of the heap allocation. It is true that
this is implementation specific, but if the underlying heap allocation
is larger than the requested allocation, the program might not be
vulnerable.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
