BTFuzz: Accurately Fuzzing Bluetooth Host with a Simulated Non-compliant Controller

Bluetooth is widely used in the modern electronic devices such as personal computers, smart phones, various smart wears and smart home devices. The widespread use of Bluetooth brings new security challenges to user privacy the ------ vulnerabilities in the Bluetooth stack allow hackers to compromise electronic devices by the air. In this paper, we present a fuzzing approach to automated test the host part of Bluetooth Low Energy (BLE), specifically, the widely used Linux BlueZ implementation. Compared to existing fuzzing work that test the full BLE stack (from the air through the controller and then to host), we directly test the host implementation, which bring two novel ideas. First, we build a simulated non-compliant software controller, and leverage the HCI to talk to BlueZ, which free us from using a hardware controller. Second, we build a BLE model based on HCI, so that we can fake a Bluetooth pair by generating valid HCI packets consumed by BlueZ. In this way, we eliminate the data processing procedure in the Bluetooth controller, thus shortening the data processing pipeline (from air-controller-host to HCI-host). As a result, we significantly increase the fuzzing throughput. Moreover, if we find a vulnerability, we can confirm it exists in host part of BLE and easily reproduce it, instead of leaving it to exhausting human analysis. We implemented our approach as BTFuzz and evaluated it. Results show that BTFuzz successfully excavates a known vulnerability, CVE-2020-12351, showing the effectiveness of our framework.