论文标题
L2Fuzz：使用状态模糊测试发现蓝牙L2CAP漏洞
L2Fuzz: Discovering Bluetooth L2CAP Vulnerabilities Using Stateful Fuzz Testing
论文作者
论文摘要
蓝牙基本速率/增强数据速率（BR/EDR）是数十亿个设备中使用的无线技术。最近，已经进行了一些蓝牙模糊研究，以检测蓝牙设备中的脆弱性，但它们没有有效地产生畸形的数据包。在本文中，我们提出了L2Fuzz，这是一种状态的模糊器，以检测蓝牙BR/EDR逻辑链接控制和适应协议（L2CAP）层中的漏洞。通过为每个状态选择有效的命令并仅突变数据包的核心字段，L2Fuzz可以生成有效的畸形数据包，这些数据包较少被目标设备拒绝。我们的实验结果证实：（1）L2Fuzz产生的畸形数据包高达46倍，与现有技术相比，数据包排斥比少得多，并且（2）L2Fuzz从八个现实世界中检测到的五个零日漏洞。
Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) is a wireless technology used in billions of devices. Recently, several Bluetooth fuzzing studies have been conducted to detect vulnerabilities in Bluetooth devices, but they fall short of effectively generating malformed packets. In this paper, we propose L2FUZZ, a stateful fuzzer to detect vulnerabilities in Bluetooth BR/EDR Logical Link Control and Adaptation Protocol (L2CAP) layer. By selecting valid commands for each state and mutating only the core fields of packets, L2FUZZ can generate valid malformed packets that are less likely to be rejected by the target device. Our experimental results confirmed that: (1) L2FUZZ generates up to 46 times more malformed packets with a much less packet rejection ratio compared to the existing techniques, and (2) L2FUZZ detected five zero-day vulnerabilities from eight real-world Bluetooth devices.
