Date: Wed, 21 Aug 2019 21:00:59 -0700 From: Eric Biggers <ebiggers@...nel.org> To: Andrey Konovalov <andreyknvl@...il.com> Cc: oss-security@...ts.openwall.com Subject: Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 On Tue, Aug 20, 2019 at 08:20:34PM +0200, Andrey Konovalov wrote: > Hi! > > I've previously reported vulnerabilities in the Linux kernel USB > drivers on this list  found with syzkaller . The USB fuzzing > project has been on hold for a while, but has been resumed earlier > this year. Here's a new bunch of 15 CVEs. > > As an experiment this time I've requested CVEs for 2 bugs > (CVE-2019-15290, CVE-2019-15291) that haven't yet been fixed (fixes > for the other 13 bugs are in the upstream kernel). Both have been > reported by syzbot over 4 months ago. I've made sure that these 2 bugs > are reproducible with a crafted USB device and crash a Linux laptop > (or rather crash the USB worker thread) with one of the distro > kernels. > > There are many more still not fixed bugs shown here . > >  https://www.openwall.com/lists/oss-security/2017/12/12/7 > >  https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md > >  https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb > Thanks for filing CVEs for these. FWIW, link  seems to be missing some of the USB bugs since it only includes bugs seen on the "ci2-upstream-usb" syzbot manager, when in fact USB bugs are also being reported from the "ci-upstream-kmsan-gce" manager. Based on my categorization of all open syzbot reports, as of today there are 80 USB-related ones, 52 of which have occurred in the last week. The 52 are listed at https://lore.kernel.org/linux-usb/20190822032841.GC6111@zzz.localdomain/T/#u These include use-after-frees, out of bounds reads/writes, using uninitialized memory, general protection faults, etc. More are reported each week, and syzbot has covered only a tiny percentage of Linux's USB driver code so far. - Eric
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.