Bluetooth Low Energy GATT Fuzzing: Specification To Implementation
summary
Built a Python fuzzer on top of the w framework and ran nine scenario-driven tests against open-source stacks (Zephyr/BlueZ-derived, NimBLE, Android BlueDroid) and commodity headsets. Finds include malformed prepared write request handling that yields out-of-bounds writes in Espressif example code (7 example files affected), missing error responses to oversized read blob offsets, and a Nimble timeout bug that deadlocks the stack and produces a CVE; tests reproduce crashes on real headsets.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 3:15BLE and GATT layers overview
- 9:21Attack scenarios on GATT
- 11:09Fuzzing framework setup
- 16:12Test bench and results
- 25:16Real-world device testing
- 28:51Limitations and future work
- 29:55Q&A session
related talks
10mFuzzBT: Holistic-State-Guided Fuzzing for Bluetooth Host Stack in Kernels
25mSweynTooth: Unleashing Mayhem over Bluetooth Low Energy
19mBLuEMan: A Stateful Simulation-based Fuzzing Framework for Open-Source RTOS...
47mBlueZ Meets Zephyr
35mDeep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
16mBluetooth Low Energy Security Testing with Combinatorial Methods
21mToothPicker: Apple Picking in the iOS Bluetooth Stack
45mFuzzing Android: A Recipe For Uncovering Vulnerabilities Inside System Components In Android