3 ms·
> - "There is an arbitrary limit of 10000 bytes placed on fuzzed input. There is no such limit within NSS; many structures can exceed this size. This vulnerabil
by jandrese 5y ago
> - "There is an arbitrary limit of 10000 bytes placed on fuzzed input. There is no such limit within NSS; many structures can exceed this size. This vulnerability demonstrates that errors happen at extremes"
This is the one that seemed short sighted to me. It's a completely arbitrary (and small!) limit that blinded the fuzzer to this very modest sized buffer overflow.
- js2 5y agoThe buffer holds 2K, so this limit alone which exceeds the buffer by 8K'ish didn't blind the fuzzer. It's not clear a larger input would've caught anything due to other "what went wrong" items, specifically "each component is fuzzed independently."
- a-priori 5y agoThe problem is that the search space grows (exponentially?) as you increase the fuzzer’s limit. So there’s a cost, and likely diminishing returns, to raising that limit.
- jandrese 5y agoAre they checking every possible overflow up to the max? Like no overflow at 7377 bytes, lets try 7378... While I can see targeting near natural boundaries (1025 bytes for example), you should be able to skip over most of the search space and verify that it doesn't blow up on enormous values like 16777216 bytes.
- lucb1e 5y agoIt's not that simple though. Single-variable integer overflows can be checked like that, but when the critical byte in a buffer might be at positions 1 through {bufferlength}, you have to do a shotgun approach and see if anything sticks, and at some point the number of possible combinations grows too big even for that. I'm not an expert on fuzzing myself, but generally I do see the point of having a limit here. Why, then, that limit was not chosen to be the max size for each of the length-checked inputs, I don't know. That does seem a bit more obvious, but also I just read this article so I can't prove that I wouldn't have made the same mistake.
- UncleMeat 5y agoCoverage-guided fuzzing dramatically mitigates the exponential nature of the search space. It used to be that searching for magic bits was impossible with fuzzing but now it is nearly trivial.
- moring 5y agoIs it possible to feed a fuzzer with information from static analysis to limit the search space? Such as, if you have a check like "someParameter > 0" in the code, have the fuzzer generate a positive, negative, and zero value for someParameter, but not thousands of them -- at least not based on this check alone -- because they will all behave the same.
- baby 5y agoThere's whitebox fuzzing that's starting to become a thing, when your fuzzer gets stuck you give the non-giving corpus to an SMT solver and it'll try to see if there exists an input that could uncover a new path. I'm really excited about these but haven't really followed the advances.
- jjoonathan 5y agoOh, the fools! If only they'd built it with 6001 hulls! When will they learn?
- 6chars 5y agoThank you! So many hindsight fortune tellers here.
- Terry_Roll 5y agoPredictable Human Behaviour, you can literally count on it! LOL Anyway the post mortem analysis is interesting because it gives away peoples knowledge or lack of. What is it they say? The Devil is in the detail!
- l33t2328 5y agoNot using small bounds on your fuzzing size isn’t exactly something you can only know via hindsight.
- baby 5y agoIf you increase the limit you lose in coverage as you can only do so many exec/s