Re: 1.2k bug reports for Debian, some may be security

[Alexandre Rebert <alexandre.rebert () gmail com>]

Hi,

I can confirm most of the bugs have no security implications, and
should probably not get CVEs. Given the high number of crashes we
found, it is highely likely that some will impact security though.

Mayhem considered multiple input sources during the analysis of the
23K binaries: environment variables, command line arguments, files and
standard input. Sockets was not one of them. That means that we only
need to consider two attack vectors: (1) crashes of setuid/setgid
programs, and (2) crashes with input files that are potentially
untrusted.

For (1), I have not checked whether we found crashes in setuid/setgid
programs yet. It is however straightforward to compile a list and
forward it to whoever is filing the CVEs. They might not be
exploitable, but a crash in such programs is concerning and might be
worth a CVE. Let me know if that's something you'd like us to do.

For (2), it is difficult to automatically identify such crashes. As
Steve mentioned, it may require a deep familiarity with the program.
Package maintainers or upstream developers are the most suited people
to judge whether a crash should be considered security critical. It is
an unsatisfying solution, as the burden to report vulnerabilities
would lie on them, but I don't see a way around it.

> I was under the impression from an incomplete read of the MAYHEM paper that
> it could generate shellcode for code execution, yet I'm only hearing of
> reports for crashes.  If code execution can be proven, then that may be
> informative.

Yes, that is correct. Mayhem actually generated a couple of exploits
from the crashes we found. We are currently looking at them
individually, and we will report all exploits that are security
issues.

Regards,
The Mayhem Team