HNHacker News
TopNewBestAskShowJobs

yumjum

20 karma · joined November 21, 2022

submissionscomments
yumjum··on Why CVE-2022-3602 was not detected by fuzz testing
Loads of bugs aren't detected by fuzz testing, as this technique exhibits stochastic behaviour, where you'll most likely find bugs overall, but have varying chances (including none at all) of uncovering specific bugs.

Which is great news for those of us who approach such research by gaining a deep understanding of the code and the systems it exists in, and figuring out vulnerabilities from that perspective. An overreliance on fuzzing keeps us employed.