[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171108120538.GA31417@openwall.com>
Date: Wed, 8 Nov 2017 13:05:38 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Andrey Konovalov <andreyknvl@...il.com>,
Dmitry Vyukov <dvyukov@...gle.com>,
Kostya Serebryany <kcc@...gle.com>
Subject: Re: Linux kernel: multiple vulnerabilities in the USB subsystem
On Mon, Nov 06, 2017 at 02:45:01PM +0100, Andrey Konovalov wrote:
> Below are the details for 14 vulnerabilities found with syzkaller in
> the Linux kernel USB subsystem. All of them can be triggered with a
> crafted malicious USB device in case an attacker has physical access
> to the machine.
Perhaps not only in that case, but also in case an attacker has remote
access to a USB device (perhaps most commonly via remote access to the
machine, with privileges to access the USB device) sufficient to replace
that device's firmware (thereby crafting a malicious device).
For example, many USB-connected FPGA boards, Bitcoin miners ("ASICs"),
etc. may reasonably be made available to a non-root user (such as via
udev rules), and they commonly permit microcontroller firmware update to
be performed via USB as well. John the Ripper bleeding-jumbo currently
loads firmware into MCUs on ZTEX 1.15y boards at startup (if the
firmware in EEPROM is different), and we recommend running it as
non-root with udev rules setup to grant access to non-root users in
group "ztex" (this setup is described in doc/README-ZTEX).
Many mainstream devices (mice, etc.) probably permit firmware update via
USB as well. Hopefully, it's uncommon to have them directly accessible
by non-root.
And no, I don't think these vulnerabilities should be a reason to run
programs as root instead of granting access to non-root. Rather, this
is a reminder that by granting access we expose more of the kernel's
attack surface (and particularly fragile parts of it), so access should
be granted to sufficiently trusted (pseudo-)user accounts only. Such
direct access is often also sufficient to backdoor or brick the devices,
which should be a concern anyway.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
