Linux Has a USB Driver Security Problem (bleepingcomputer.com)

Catalin Cimpanu, reporting for BleepingComputer: USB drivers included in the Linux kernel are rife with security flaws that in some cases can be exploited to run untrusted code and take over users' computers. The vast majority of these vulnerabilities came to light on Monday, when Google security expert Andrey Konovalov informed the Linux community of 14 vulnerabilities he found in the Linux kernel USB subsystem. "All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine," Konovalov said. The 14 flaws are actually part of a larger list of 79 flaws Konovalov found in Linux kernel USB drivers during the past months. Not all of these 79 vulnerabilities have been reported, let alone patched. Most are simple DoS (Denial of Service) bugs that freeze or restart the OS, but some allow attackers to elevate privileges and execute malicious code.

Comments

an attacker has physical access to the machine

[Anonymous Coward]

you're already pwned

Re:an attacker has physical access to the machine

[Calydor]

If all it takes is access to plug in a USB dongle, that's a different kind of access than being able to open up the machine and tinker with it. Secretary turns her back for a moment? Plug it in while you can.

Hell, with the tendency for people to plug in USB keys found on the street still to this day, that's all that would be required to exploit these flaws in an otherwise impenetrable building.

Re:an attacker has physical access to the machine

[squiggleslash]

Secretary turns her back for a moment? Plug it in while you can.

Wow, Hollywood has actually been accurately portraying the state of security in Linux for years, and nobody realized!

Re:an attacker has physical access to the machine

[Jeremi]

Wow, Hollywood has actually been accurately portraying the state of security in Linux for years, and nobody realized!

If it turns out that the secretaries of the world have been running Linux all these years, I will be rather surprised :)

Re:an attacker has physical access to the machine

[cstacy]

Secretary turns her back for a moment? Plug it in while you can.

Wow, Hollywood has actually been accurately portraying the state of security in Linux for years, and nobody realized!

No, they haven't been portraying it accurately for years. But in the last few weeks we have seen actresses and secretaries in Hollywood coming forward with the story of what happens when they turn their backs and executive producers try to "plug it in while they can".

Re:an attacker has physical access to the machine

[tlhIngan]

Of course, all it takes is a few plug-in attempts to create kernel panics...or is that moral panics?

I've had it happen to me while I was developing a USB device. Plugged it into a Linux machine and it kernel panics immeidately. No, plug it into Windows and nothing happens.

It turned out I screwed up the USB descriptors I was returning - Linux didn't like that I set the descriptor type wrong.

Granted, this is something I did many many many years ago (around the time of the great east cost blackout) so I expect that it would be somewhat more robust now.

It's also interesting to see how different OSes reacted - the USB descriptor is a fixed size, but some OSes (Windows, notably) only do a partial request - I think it was 5 bytes - in order to get the USB descriptor type and length bytes, then it re-ran the request with the proper size. Linux at the time simply did a proper sized request - the descriptor size is fixed and unchanging so what Windows did was completely unnecessary unless it was to ensure that devices responded properly.