[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 22 Aug 2019 19:17:34 +0100
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: multiple vulnerabilities in the USB
subsystem x2
> On 22 Aug 2019, at 18:57, Perry E. Metzger <perry@...rmont.com> wrote:
>
>> Are these [null pointer deref] even realistic? If I'm going to leave malicious
>> USB devices in the parking lot for mischief am I going to rely
>> on the unknown victim running a Linux distro with the
>> requisite kernel modules or am I going to just drop a cheap
>> and near-universal USB killer?
>
> Android phones run Linux. People routinely plug those phones in to USB
> charging stations in airports, on airplanes, at booths in public
> places, etc.
>
If I'm going to attack random devices I'm not going to do it with some random driver that may or may not be present on a phone. And as this is a null pointer reference we're talking about you plug the phone and and it reboots so you won't do that more than once. That's it, that's the limit of the vulnerability.
If I'm going to go to the trouble of emulating a device so I can sneak it into a public charging point I'm not going to do it just to make a phone reboot. I'm going to pick a UAF vulnerability with an exploit that actually does something useful, something beyond just making the phone reboot.
Either that or I'm going to sneak in a USB killer and destroy the phones.
No matter what, emulating a device just to cause a null dereference is not CVE worthy. If it is, then we need a CVE for power buttons on laptops and phones.
jch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
