Introduction
I noticed that the network subsystem was already being fuzzed extensively by syzkaller, but that subsystems like Bluetooth were less well covered. In general, research on the Bluetooth host attack surface seemed to be quite limited – with most public vulnerabilities in Bluetooth only affecting the firmware or the specification itself, and only allowing attackers to eavesdrop and/or manipulate information.
But what if attackers could take full control over devices? The most prominent examples that demonstrated this scenario were BlueBorne and BlueFrag. I set myself the goal to research the Linux Bluetooth stack, to extend upon BlueBorne’s findings, and to extend syzkaller with the capability to fuzz the
Bluetooth Controller Synopsys’ DesignWare® Controller IP for Bluetooth low energy, Thread, and Zigbee delivers secure, concurrent wireless connectivity for Internet of Things (IoT) applications such as wearables, industrial, smart homes, and smart cities. The controller incorporates advanced data encryption and random number generation for secure wireless connections, and allows multiple simultaneous connections between supported protocols in a single instantiation. It also provides validated interoperability with software stacks through a physical or a virtual Host Controller Interface (HCI). The IP is delivered as RTL and firmware corresponding to an optimized IP partition to minimize system power dissipation and allow for functionality upgrades through software updates. The firmware runs on an external processor that can either be a dedicated processor or host processor. The controller is thoroughly tested and qualified in accordance with the Bluetooth Special Interest Gr