2

Is there a list of vulnerabilities that have been found in Bitcoin Core using fuzz testing?

1

For a list of historical Bitcoin related CVEs (common vulnerabilities and exposures) see the Bitcoin wiki.

However, for a focus on Bitcoin Core vulnerabilities found by fuzzing there is a resource on the Bitcoin Core dev wiki on "fuzz trophies".

Marco Falke stated here in May 2021:

I did a survey of all bugs found first by fuzzing, excluding known bugs that can merely be reproduced by fuzzing (regression fuzz testing). I found that most bugs fall into one of the categories:

  • Silent merge conflict (forgetting to update the fuzz target after code changes)
  • A bug in the fuzz target itself
  • A recently introduced critical (exploitable) bug, but only present in the master main development branch
  • A minor (non-exploitable) bug, potentially present in previous releases

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.