oss-sec mailing list archives
Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE?
From: Eric Biggers <ebiggers () kernel org>
Date: Tue, 8 Dec 2020 12:31:37 -0800
On Tue, Dec 08, 2020 at 08:01:14PM +0100, yersinia wrote:
At this link, multiple security bugs of various kinds are highlighted in very widespread basic cryptographic applications, which have then been corrected. I haven't done a deep analysis on all of them but I haven't found any associated CVEs of some of them. Do I have to assume that they weren't all that important or that the process of reporting them was missing? Thanks https://github.com/guidovranken/cryptofuzz
Fuzzing can easily find large numbers of bugs, and it's usually unclear what the security impact of them is. So if people want CVEs, someone has to actually put the effort into analyzing each bug and (if applicable) filing for a CVE. Presumably just no one has done that for the above bugs. Something similar happened when I added fuzz tests to the Linux kernel's crypto API last year. In less than a year they had resulted in over 100 bug fixes. Most didn't *seem* too concerning, e.g. most were bugs in crypto drivers that seemed to be rarely used, or crypto algorithms that seemed to be rarely used, or edge cases in the crypto API that seemed to be rarely or never encountered. The bugs in userspace libraries found by cryptofuzz look somewhat similar. They include some of the same kinds of bugs, like mishandling zero-length inputs, mishandling data passed in specific chunk sizes, or bugs in weird algorithms. However, in both cases it isn't possible to be certain of the impact and applicability for a CVE of each bug without analyzing each bug in detail, which would be very time-consuming, and in general it's no one's job to do that. Likewise, syzkaller has found thousands of Linux kernel bugs and most haven't had CVEs filed. - Eric
Current thread:
- Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? yersinia (Dec 08)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Eric Biggers (Dec 08)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Robert Watson (Dec 08)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Seth Arnold (Dec 08)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Douglas Bagnall (Dec 15)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Robert Watson (Dec 08)
- Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE? Eric Biggers (Dec 08)