3 ms·
I wonder how many of these are found by hand versus with automated tools like Asan and AFL. Seems like some of these would be really hard to spot...
by epmatsw 11y ago
I wonder how many of these are found by hand versus with automated tools like Asan and AFL. Seems like some of these would be really hard to spot...
- tptacek 11y agoLogjam was found with model-checking software, right?
- hannob 11y agoI can answer that I found CVE-2015-1789 twice with afl (through different input vectors) and a couple of other issues that were not security-relevant. I'd assume that the null ptr pkcs#7 issue found by Michal Zalewski was also afl and the ecc issue as well (as documented by its founder). The CMS loop issue sounds also like it could've been found by fuzzing. It's important to keep in mind what fuzzing can and can't do. It is a great method to find some bugs, but it has its limitations and can only find a certain class of bugs.
- f- 11y agoYep, the two PKCS bugs were from afl-fuzz.