Uncovering Bluetooth vulnerabilities with binary coverage-guided fuzz testing and controller emulation

Zhao Min Chen

doi:10.1016/j.cose.2026.104929

Uncovering Bluetooth vulnerabilities with binary coverage-guided fuzz testing and controller emulation

2026-04-25

0

PRE

AI

DOI：10.1016/j.cose.2026.104929

Original

Original request for help

Save

Abstract

En 中文

• We present FuBuKi, a binary-rehosting fuzzing framework for binary-only Bluetooth BR/EDR host stacks that uses HCI emulation and does not require physical Bluetooth hardware. • FuBuKi uses a profile-aware proxy to reach high-level application profiles above L2CAP, enabling coverage-guided fuzzing of stateful targets such as SDP, RFCOMM, and AVRCP. • In fair 24-hour evaluations under both post-handshake and pre-handshake settings, FuBuKi achieves higher code coverage than representative state-of-the-art baselines. • The framework’s efficacy is validated by discovering a potential 0-day vulnerability in a commercial automotive firmware and rediscovering a known CVE in Linux BlueZ.

Keywords:

binary fuzzing

Bluetooth BR/EDR

HCI emulation

coverage-guided fuzzing

vulnerability discovery

Uncovering Bluetooth vulnerabilities with binary coverage-guided fuzz testing and controller emulation

Abstract

Journal

Organization