oss-sec mailing list archives
Re: Fuzzing project brainstorming
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 20 Nov 2014 08:38:38 -0700
The most important part of all: who's going to interpret the fuzzing results and then co-ordinate with upstreams to make source code fixes? Fuzzing is the easy part, fixing the code... not so much. It's not that the devs don't feel this is important, but that they have a million other things to do, plus personal lives/etc. If this was easy we wouldn't have any tmp vulns, witness the push back on something as simple as "please just use mkstemp!" from various devs. On 20/11/14 05:34 AM, Hanno Böck wrote:
Hi, Following the discussions here I feel this whole fuzzing thing could need a project to coordinate efforts and I will probably start something within the following days. I wanted to lay out my rough plans / brainstorming and welcome any feedback and especially if people have worries about such a project. * The core of the project will be a list of free software projects that in one way or another parse fileformats (I'll leave fuzzing network and other input out for now). It should have rough categories (ok = fuzzed and no unfixed issues in latest release, wip: fuzzed and issues are being worked on or already fixed in source repo, stale: fuzzed and issues don't seem to be worked on, unavalable = project with no developers to contact, wontfix = developers don't feel memory access issues and crashes need to be fixed / declare their product unsuitable for untrusted input, unknown = no known fuzzing efforts) I feel that it's important to make the limitation of this info transparent (e.g. about to change rapidly, always further /different fuzzing strategies that might turn up more issues, fuzzing is not a good indicator for overall security etc.). * A sharing place for stuff that might be useful for fuzzing, I think especially about patches that disable sanity checks (CRCs etc.) that make fuzzing harder. And maybe file collections with small example files for various file formats. * Some introduction tutorials that should give people with no fuzzing experience a starter. Preferrably so easy that everyone with some basic linux/unix knowledge can follow them. Explain zzuf, asan, afl. * All kinds of pointers/links to further information. Data and things like file archive should preferrably be public domain / cc0 to make data sharing as easy as possible. I welcome your feedback. I also welcome all reports (preferrably with links to public sources where this is documented - bugtrackers, mailing list archives etc.) of fuzzing. The good ("I fuzzed this for so long and it seems just nothing turned up") and the bad ("I found 10.000 unique crashers and reported them all upstream, nobody cares"). cu,
-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Kurt Seifried (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Sven Kieske (Nov 20)
- Re: Fuzzing project brainstorming Amos Jeffries (Nov 20)
- Re: Fuzzing project brainstorming Gynvael Coldwind (Nov 20)
- Re: Fuzzing project brainstorming Michal Zalewski (Nov 20)
- Re: Fuzzing project brainstorming Alexander Cherepanov (Nov 20)
- Re: Fuzzing project brainstorming Gynvael Coldwind (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Kurt Seifried (Nov 20)
- Re: Re: Fuzzing project brainstorming Hanno Böck (Nov 20)