Date: Mon, 3 Dec 2018 17:45:30 +0100 From: Mathias Payer <mathias.payer@...elwelt.net> To: oss-security@...ts.openwall.com Subject: UAF write in usb_audio_probe Hi there, We reported a security bug to security@...nel.org we discovered in the Linux kernel when fuzzing the hardware/software interface, targeting malicious USB peripherals. We have developed a fuzzing infrastructure that emulates malicious USB peripherals, allowing a fuzzer to feed test input into a virtualized kernel. We have tested 8 different recent kernel versions and have found new 37 bugs (so far). A first glimpse at all discovered vulnerabilities shows that they contain a set of arbitrary reads and arbitrary writes. The attacker needs local access to plug in a malicious USB device that replays the trace (e.g., through FaceDancer) to get read/write primitives in the kernel. For, e.g., Android or locked Desktops this becomes security critical. This turns these bugs into local "pop the box" opportunities, e.g., to disable screen locks or gain root. We can provide input USB seeds/traces for all discovered bugs/vulnerabilities and will report the other bugs as we triage them. Note that we submitted the paper that presents the technique to the Dec 01 IEEE Security and Privacy deadline. So far, we have submitted one bug (and patch) to alsa-devel@...a-project.org (after discussing both with the security@...nel.org list). This bug is likely exploitable, allowing a local user (not logged in) to gain a write primitive in the kernel by simply plugging in a malicious USB device. The patch is at: https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=5f8cf712582617d523120df67d392059eaf2fc4b Thanks, Mathias Payer Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.