Broken Brokers in Boxes: Fuzzing Breaks Everything, Even Erlang
summary
Three vulnerabilities appear in RabbitMQ, EMQX, VerneMQ found by protocol fuzzing of AMQP and MQTT. One concrete exploit is a crafted TLV message where a single TLV type change causes RabbitMQ to allocate until the VM is killed; reproducing the failure uses a script that sends the protocol header then the anomalous open frame. Generational/model-based fuzzing targets TLVs and length fields, and running brokers in a 0.5 GB container, no swap reliably reveals resource exhaustion faults.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:33What is a Message Broker?
- 3:30The Vulnz
- 4:18Stuff Blowing Up
- 6:00Our Favorite Definition of Fuzzing
- 7:04Fuzzing Domains
- 8:43Some Test Cases are Better Than Others
- 14:40Protocols are Conversations
- 16:03Type Length Value (TLV) Structures
- 19:33Spot the Difference
- 21:08It's Not Just About Process Crashes
- 22:20"Safer" Environments Deny Some Failures
- 23:45Bugs and Failure Modes
- 26:50Erlang's "Fail Fast" Inverts Protocol Parsing
- 28:18Parsing is Always Tricky
- 29:36VM Architecture Provides Insulation
- 31:01Memory Exhaustion Can Be Hard to See and Reprd
- 32:52Containers Provide Easy Constraints
- 34:18This is the Magic
- 37:57Thank You
related talks
53mThree Colours of Fuzzing: Reflections and Open Challenges
49mPwning Your Java Messaging With Deserialization Vulnerabilities
39mFuzzing: Finding Your Own Bugs and 0days!
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
05mLightning Talk: Securing Envoy: Catching Vulnerabilities With Continuous Fuzz Testing
29mHow Protocol Gateways May Introduce More Problems than They Solve
10mSNFuzz: Gateway-Centric State-Oriented Fuzzing for MQTT-SN
53mFuzz Testing for Fun and Profit