5 ms·
From their blog [1] the vulnerability "was reported in private to OpenSSL on 17th October 2022 by Polar Bear who was performing an audit of OpenSSL code". OpenS
by Arcuru 4y ago
From their blog [1] the vulnerability "was reported in private to OpenSSL on 17th October 2022 by Polar Bear who was performing an audit of OpenSSL code". OpenSSL 3.0 was released in September 2021.
Shouldn't fuzzing have caught this at some point? I was under the impression that OpenSSL was being fuzz tested constantly since Heartbleed.
[1] https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ https://www.openssl.org/blog/blog/2022/11/01/email-address-o...
- userbinator 4y agoShouldn't fuzzing have caught this at some point? Eventually, yes. Unfortunately, fuzzing is usually nondeterministic/pseudorandom so it won't necessarily go down the path that leads to the bug soon enough.
- bink 4y agoIt sounds like the fuzzer would have had to use an arbitrary number of bytes containing '.' and the cert would've had to pass chain of trust verification. A fuzzer is only as strong as its implementation.
- contravariant 4y agoI hope they're not just fuzzing random bytes, in theory that would take forever to trigger any code other than just rejecting the certificate.
- whizzter 4y agoIirc fuzzers would add randomness and measure occurences of newly entered codepaths and build out from previous randomness to reach more codepaths. However as you noted, in this case the cryptographic verification code would in practice always be hit before any sany progress could be done in fuzzing any deeper. To catch this they would've needed to make a specific fuzzing setup where the process prepared random certificates that are THEN signed and passed further and make the fuzzer short-circuit anything where the random cerificate failed the signing to actually test verification.
- fulafel 4y agoFuzzing is searching the vast input space with various rough heuristics to try to weigh more error prone paths to generate test inputs for. It's incomplete by nature.
- deleted 4y ago[deleted]
- AtNightWeCode 4y agoThis seems more difficult to find with fuzz tests than Heartbleed. Unit tests of all edge values would have found this. I think the solution is to use better tools and methodology. The size of the code base is also just daunting and a security risk in itself.