oss-security - UAF write in usb_audio

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <d20eaeb9-c8ce-1806-6359-8e22f53b9994@nebelwelt.net>
Date: Mon, 3 Dec 2018 17:45:30 +0100
From: Mathias Payer <mathias.payer@...elwelt.net>
To: oss-security@...ts.openwall.com
Subject: UAF write in usb_audio_probe

Hi there,

We reported a security bug to security@...nel.org we discovered in the Linux
kernel when fuzzing the hardware/software interface, targeting malicious USB
peripherals. We have developed a fuzzing infrastructure that emulates malicious
USB peripherals, allowing a fuzzer to feed test input into a virtualized kernel.
We have tested 8 different recent kernel versions and have found new 37 bugs (so
far). A first glimpse at all discovered vulnerabilities shows that they contain
a set of arbitrary reads and arbitrary writes.

The attacker needs local access to plug in a malicious USB device that replays
the trace (e.g., through FaceDancer) to get read/write primitives in the kernel.
For, e.g., Android or locked Desktops this becomes security critical. This turns
these bugs into local "pop the box" opportunities, e.g., to disable screen locks
or gain root.

We can provide input USB seeds/traces for all discovered bugs/vulnerabilities
and will report the other bugs as we triage them. Note that we submitted the
paper that presents the technique to the Dec 01 IEEE Security and Privacy deadline.

So far, we have submitted one bug (and patch) to alsa-devel@...a-project.org
(after discussing both with the security@...nel.org list). This bug is likely
exploitable, allowing a local user (not logged in) to gain a write primitive in
the kernel by simply plugging in a malicious USB device.
The patch is at:
https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=5f8cf712582617d523120df67d392059eaf2fc4b

Thanks,
Mathias Payer

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.