[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+fCnZc5Qd0wkabhMgfte8OpPmTiYbT+pL7UC7xq6W_DMj1BZw@mail.gmail.com>
Date: Fri, 25 Oct 2019 20:09:01 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: oss-security@...ts.openwall.com
Cc: mathias.payer@...elwelt.net, Hui Peng <benquike@...il.com>
Subject: Do distros want to see CVEs for Linux kernel USB bugs?
Hi!
As we keep getting more USB bugs reported by syzbot [1], I'd like to
figure out what to do with those in regards to CVEs. Last time I
requested a bunch of CVEs for USB bugs, there was a long discussion
about whether that is the right thing to do, see the full thread here
[2].
I don't want to argue now whether CVEs are useful for the upstream
Linux kernel. My question is: with CVEs as they work today, do Linux
distros want to see CVEs filed for Linux kernel bugs that are
triggerable by a malicious USB device?
Since not all USB bugs are the same, let's bucket them into:
1. Different kinds of DoS (e.g. null-ptr-deref).
2. Info / uninitialized memory leaks.
3. Bugs that lead to arbitrary code execution.
4. Non-triaged memory corruptions (UAF/OOB).
Points 1-3 refer to the bugs that have been assessed for the impact
that they cause, while point 4 refers to the bugs that haven't been
looked at closely.
Keep in mind that:
1. Most of the time physical access to the USB port is required to
trigger these bugs.
2. Sometimes, in cases of e.g. exposed USB/IP or USBAnywhere like
vulnerabilities [3] these bugs can be triggered remotely.
Thanks!
[1] https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb
[2] https://www.openwall.com/lists/oss-security/2019/08/20/2
[3] https://github.com/eclypsium/USBAnywhere
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
