Re: Bugs found by Cryptofuzz - some missing CVEs or too low impact for CVE?

[Robert Watson <robertcwatson1 () gmail com>]

Question from a retired programmer but security novice... Since fuzzing is
used to find bugs in other programs, doesn't it need to be held to a bit
higher standard in order to maintain credibility?

On Tue, Dec 8, 2020, 16:12 Eric Biggers <ebiggers () kernel org> wrote:

> On Tue, Dec 08, 2020 at 08:01:14PM +0100, yersinia wrote:
> > At this link, multiple security bugs of various kinds are highlighted in
> > very widespread basic cryptographic applications, which have then been
> > corrected. I haven't done a deep analysis on all of them but I haven't
> > found any associated CVEs of some of them. Do I have to assume that they
> > weren't all that important or that the process of reporting them was
> > missing? Thanks
> >
> > https://github.com/guidovranken/cryptofuzz
>
> Fuzzing can easily find large numbers of bugs, and it's usually unclear
> what the
> security impact of them is.  So if people want CVEs, someone has to
> actually put
> the effort into analyzing each bug and (if applicable) filing for a CVE.
> Presumably just no one has done that for the above bugs.
>
> Something similar happened when I added fuzz tests to the Linux kernel's
> crypto
> API last year.  In less than a year they had resulted in over 100 bug
> fixes.
> Most didn't *seem* too concerning, e.g. most were bugs in crypto drivers
> that
> seemed to be rarely used, or crypto algorithms that seemed to be rarely
> used, or
> edge cases in the crypto API that seemed to be rarely or never encountered.
>
> The bugs in userspace libraries found by cryptofuzz look somewhat
> similar.  They
> include some of the same kinds of bugs, like mishandling zero-length
> inputs,
> mishandling data passed in specific chunk sizes, or bugs in weird
> algorithms.
>
> However, in both cases it isn't possible to be certain of the impact and
> applicability for a CVE of each bug without analyzing each bug in detail,
> which
> would be very time-consuming, and in general it's no one's job to do that.
>
> Likewise, syzkaller has found thousands of Linux kernel bugs and most
> haven't
> had CVEs filed.
>
> - Eric