[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20191026064347.GR7189@suse.de>
Date: Sat, 26 Oct 2019 08:43:47 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: mathias.payer@...elwelt.net, Hui Peng <benquike@...il.com>
Subject: Re: Do distros want to see CVEs for Linux kernel USB
bugs?
On Fri, Oct 25, 2019 at 08:09:01PM +0200, Andrey Konovalov wrote:
> Hi!
>
> As we keep getting more USB bugs reported by syzbot [1], I'd like to
> figure out what to do with those in regards to CVEs. Last time I
> requested a bunch of CVEs for USB bugs, there was a long discussion
> about whether that is the right thing to do, see the full thread here
> [2].
>
> I don't want to argue now whether CVEs are useful for the upstream
> Linux kernel. My question is: with CVEs as they work today, do Linux
> distros want to see CVEs filed for Linux kernel bugs that are
> triggerable by a malicious USB device?
>
> Since not all USB bugs are the same, let's bucket them into:
>
> 1. Different kinds of DoS (e.g. null-ptr-deref).
> 2. Info / uninitialized memory leaks.
> 3. Bugs that lead to arbitrary code execution.
> 4. Non-triaged memory corruptions (UAF/OOB).
>
> Points 1-3 refer to the bugs that have been assessed for the impact
> that they cause, while point 4 refers to the bugs that haven't been
> looked at closely.
>
> Keep in mind that:
>
> 1. Most of the time physical access to the USB port is required to
> trigger these bugs.
> 2. Sometimes, in cases of e.g. exposed USB/IP or USBAnywhere like
> vulnerabilities [3] these bugs can be triggered remotely.
>
> Thanks!
>
> [1] https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb
>
> [2] https://www.openwall.com/lists/oss-security/2019/08/20/2
>
> [3] https://github.com/eclypsium/USBAnywhere
As discussed previously, "denial of service" (e.g. NULL ptr) via USB
device seems not to classify as CVE. (With the guidance that with physical
access you can cause more "denial of service" in other ways, like powering down the machine.)
So 2-3 could be CVE worthy from a distro perspective.
For 4 I would assume reasonable guess work if its "just" a denial of service or
more for CVE guidance.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
