[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <X8/iqSaDQqige53U@gmail.com>
Date: Tue, 8 Dec 2020 12:31:37 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: yersinia <yersinia.spiros@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Bugs found by Cryptofuzz - some missing CVEs or
too low impact for CVE?
On Tue, Dec 08, 2020 at 08:01:14PM +0100, yersinia wrote:
> At this link, multiple security bugs of various kinds are highlighted in
> very widespread basic cryptographic applications, which have then been
> corrected. I haven't done a deep analysis on all of them but I haven't
> found any associated CVEs of some of them. Do I have to assume that they
> weren't all that important or that the process of reporting them was
> missing? Thanks
>
> https://github.com/guidovranken/cryptofuzz
Fuzzing can easily find large numbers of bugs, and it's usually unclear what the
security impact of them is. So if people want CVEs, someone has to actually put
the effort into analyzing each bug and (if applicable) filing for a CVE.
Presumably just no one has done that for the above bugs.
Something similar happened when I added fuzz tests to the Linux kernel's crypto
API last year. In less than a year they had resulted in over 100 bug fixes.
Most didn't *seem* too concerning, e.g. most were bugs in crypto drivers that
seemed to be rarely used, or crypto algorithms that seemed to be rarely used, or
edge cases in the crypto API that seemed to be rarely or never encountered.
The bugs in userspace libraries found by cryptofuzz look somewhat similar. They
include some of the same kinds of bugs, like mishandling zero-length inputs,
mishandling data passed in specific chunk sizes, or bugs in weird algorithms.
However, in both cases it isn't possible to be certain of the impact and
applicability for a CVE of each bug without analyzing each bug in detail, which
would be very time-consuming, and in general it's no one's job to do that.
Likewise, syzkaller has found thousands of Linux kernel bugs and most haven't
had CVEs filed.
- Eric
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
