  Bluetooth Basic Rate/Enhanced Data Rate (BR/EDR) is a wireless technology
used in billions of devices. Recently, several Bluetooth fuzzing studies have
been conducted to detect vulnerabilities in Bluetooth devices, but they fall
short of effectively generating malformed packets. In this paper, we propose
L2FUZZ, a stateful fuzzer to detect vulnerabilities in Bluetooth BR/EDR Logical
Link Control and Adaptation Protocol (L2CAP) layer. By selecting valid commands
for each state and mutating only the core fields of packets, L2FUZZ can
generate valid malformed packets that are less likely to be rejected by the
target device. Our experimental results confirmed that: (1) L2FUZZ generates up
to 46 times more malformed packets with a much less packet rejection ratio
compared to the existing techniques, and (2) L2FUZZ detected five zero-day
vulnerabilities from eight real-world Bluetooth devices.
