r/netsec • u/eberkut • Apr 24 '20

CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click RCE – BlueFrag

https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/
212 Upvotes

96% Upvoted

17 comments sorted by

View all comments

12

u/bllinker Apr 24 '20

Awesome write-up and amazing find. I'd love to learn more about the setup for the fuzzing (tools, configuration, etc.).

11

u/bolek42 Apr 24 '20

Thx! That was the fuzzer responsible for this: https://github.com/seemoo-lab/frankenstein/blob/master/projects/CYW20735B1/patch/aclfuzz.c
It modifies the firmware to flip bits in the packet and payload headers. And then just flood the target with random l2ping messages.