[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CA+-XxSH0BqMYE51UAjNynhdCkecCv45q9pKanRRyyH=iWhDDUQ@mail.gmail.com>
Date: Sat, 26 Oct 2019 06:37:29 -0700
From: Igor Seletskiy <i@...udlinux.com>
To: oss-security@...ts.openwall.com
Cc: mathias.payer@...elwelt.net, Hui Peng <benquike@...il.com>
Subject: Re: Do distros want to see CVEs for Linux kernel USB bugs?
I thought the DoS issue wasn't settled specifically due to USB over IP.
Regards,
Igor Seletskiy | CEO
CloudLinux OS <https://cloudlinux.com/cloudlinuxos> | KernelCare
<https://www.cloudlinux.com/kernelcare> | Imunify360
<http://imunify360.com/>
Get 24/7 free, exceptionally good support at cloudlinux.zendesk.com
Follow us on twitter for technical updates: @CloudLinuxOS
<https://twitter.com/cloudlinuxos>
On Fri, Oct 25, 2019 at 11:44 PM Marcus Meissner <meissner@...e.de> wrote:
> On Fri, Oct 25, 2019 at 08:09:01PM +0200, Andrey Konovalov wrote:
> > Hi!
> >
> > As we keep getting more USB bugs reported by syzbot [1], I'd like to
> > figure out what to do with those in regards to CVEs. Last time I
> > requested a bunch of CVEs for USB bugs, there was a long discussion
> > about whether that is the right thing to do, see the full thread here
> > [2].
> >
> > I don't want to argue now whether CVEs are useful for the upstream
> > Linux kernel. My question is: with CVEs as they work today, do Linux
> > distros want to see CVEs filed for Linux kernel bugs that are
> > triggerable by a malicious USB device?
> >
> > Since not all USB bugs are the same, let's bucket them into:
> >
> > 1. Different kinds of DoS (e.g. null-ptr-deref).
> > 2. Info / uninitialized memory leaks.
> > 3. Bugs that lead to arbitrary code execution.
> > 4. Non-triaged memory corruptions (UAF/OOB).
> >
> > Points 1-3 refer to the bugs that have been assessed for the impact
> > that they cause, while point 4 refers to the bugs that haven't been
> > looked at closely.
> >
> > Keep in mind that:
> >
> > 1. Most of the time physical access to the USB port is required to
> > trigger these bugs.
> > 2. Sometimes, in cases of e.g. exposed USB/IP or USBAnywhere like
> > vulnerabilities [3] these bugs can be triggered remotely.
> >
> > Thanks!
> >
> > [1] https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb
> >
> > [2] https://www.openwall.com/lists/oss-security/2019/08/20/2
> >
> > [3] https://github.com/eclypsium/USBAnywhere
>
> As discussed previously, "denial of service" (e.g. NULL ptr) via USB
> device seems not to classify as CVE. (With the guidance that with physical
> access you can cause more "denial of service" in other ways, like powering
> down the machine.)
>
> So 2-3 could be CVE worthy from a distro perspective.
>
> For 4 I would assume reasonable guess work if its "just" a denial of
> service or
> more for CVE guidance.
>
> Ciao, Marcus
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
