Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 20 Aug 2019 20:20:34 +0200
From: Andrey Konovalov <andreyknvl@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel: multiple vulnerabilities in the USB subsystem x2

Hi!

I've previously reported vulnerabilities in the Linux kernel USB
drivers on this list [1] found with syzkaller [2]. The USB fuzzing
project has been on hold for a while, but has been resumed earlier
this year. Here's a new bunch of 15 CVEs.

As an experiment this time I've requested CVEs for 2 bugs
(CVE-2019-15290, CVE-2019-15291) that haven't yet been fixed (fixes
for the other 13 bugs are in the upstream kernel). Both have been
reported by syzbot over 4 months ago. I've made sure that these 2 bugs
are reproducible with a crafted USB device and crash a Linux laptop
(or rather crash the USB worker thread) with one of the distro
kernels.

There are many more still not fixed bugs shown here [3].

[1] https://www.openwall.com/lists/oss-security/2017/12/12/7

[2] https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md

[3] https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb

### CVEs

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15290

An issue was discovered in the Linux kernel through 5.2.9. There is a
NULL pointer dereference caused by a malicious USB device in the
ath6kl_usb_alloc_urb_from_pipe function in the
drivers/net/wireless/ath/ath6kl/usb.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15291

An issue was discovered in the Linux kernel through 5.2.9. There is a
NULL pointer dereference caused by a malicious USB device in the
flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c
driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15211

An issue was discovered in the Linux kernel before 5.2.6. There is a
use-after-free caused by a malicious USB device in the
drivers/media/v4l2-core/v4l2-dev.c driver because
drivers/media/radio/radio-raremono.c does not properly allocate
memory.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15212

An issue was discovered in the Linux kernel before 5.1.8. There is a
double-free caused by a malicious USB device in the
drivers/usb/misc/rio500.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15213

An issue was discovered in the Linux kernel before 5.2.3. There is a
use-after-free caused by a malicious USB device in the
drivers/media/usb/dvb-usb/dvb-usb-init.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15214

An issue was discovered in the Linux kernel before 5.0.10. There is a
use-after-free in the sound subsystem because card disconnection
causes certain data structures to be deleted too early. This is
related to sound/core/init.c and sound/core/info.c.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15215

An issue was discovered in the Linux kernel before 5.2.6. There is a
use-after-free caused by a malicious USB device in the
drivers/media/usb/cpia2/cpia2_usb.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15216

An issue was discovered in the Linux kernel before 5.0.14. There is a
NULL pointer dereference caused by a malicious USB device in the
drivers/usb/misc/yurex.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15217

An issue was discovered in the Linux kernel before 5.2.3. There is a
NULL pointer dereference caused by a malicious USB device in the
drivers/media/usb/zr364xx/zr364xx.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15218

An issue was discovered in the Linux kernel before 5.1.8. There is a
NULL pointer dereference caused by a malicious USB device in the
drivers/media/usb/siano/smsusb.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15219

An issue was discovered in the Linux kernel before 5.1.8. There is a
NULL pointer dereference caused by a malicious USB device in the
drivers/usb/misc/sisusbvga/sisusb.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15220

An issue was discovered in the Linux kernel before 5.2.1. There is a
use-after-free caused by a malicious USB device in the
drivers/net/wireless/intersil/p54/p54usb.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15221

An issue was discovered in the Linux kernel before 5.1.17. There is a
NULL pointer dereference caused by a malicious USB device in the
sound/usb/line6/pcm.c driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15222

An issue was discovered in the Linux kernel before 5.2.8. There is a
NULL pointer dereference caused by a malicious USB device in the
sound/usb/helper.c (motu_microbookii) driver.

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15223

An issue was discovered in the Linux kernel before 5.1.8. There is a
NULL pointer dereference caused by a malicious USB device in the
sound/usb/line6/driver.c driver.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.