FuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
summary
FuzzBT builds a fuzzer that iterates over kernel Bluetooth configurations and extracts configuration-aware seeds via concolic/symbolic execution, instruments the compiler to aggregate protocol state (monitoring structures like hci_conn and l2cap_chan) for stack-level state aggregation, and runs campaigns against Linux and Zephyr host stacks. It finds 18 previously unknown bugs (9 CVEs), 15 of them reachable only under specific configs, including a divide-by-zero needing LE+flow-control and dual HCI+L2CAP packets and a config-triggered init crash.
AI-written summary · about
chapters (10)
- 0:00FuzzBT introduction
- 0:51Bluetooth host stack configs
- 2:36Bluetooth fuzzing gaps
- 4:03Holistic fuzzing goals
- 5:26Corpus reuse failure
- 6:29Config-aware corpus generation
- 7:12State feedback for testing
- 8:16Bug findings and CVEs discovered
- 9:21Configuration diversity
- 9:42Conclusion
related talks
32mBluetooth Low Energy GATT Fuzzing: Specification To Implementation
21mToothPicker: Apple Picking in the iOS Bluetooth Stack
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
19mBLuEMan: A Stateful Simulation-based Fuzzing Framework for Open-Source RTOS...
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
20mKFuzzTest: Targeted Fuzzing of Internal Kernel Functions
26mFuzzing Host-to Guest Attack Surface in Android Protected KVM
13mTCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing