Date: Fri, 23 Aug 2019 04:40:30 +0100 From: Eddie Chapman <eddie@...k.net> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2 On 23/08/2019 02:13, Perry E. Metzger wrote: > On Thu, 22 Aug 2019 20:33:54 +0100 Eddie Chapman <eddie@...k.net> > wrote: >> On 22/08/2019 20:00, Perry E. Metzger wrote: >>> You can argue anything you like. Power charging points have >>> popped up around the world, and you're not in a position to stop >>> them. Furthermore, I'll note that over the air exploitable bugs in >>> things like WiFi stacks and Bluetooth stacks have also appeared >>> over time; perhaps it's foolish to have your phone on at all, and >>> yet people will continue to turn their phones on, and even to use >>> them. >> >> Well, I certainly am not deluded enough to think I have the power >> to stop power charging points popping up everywhere :-) Or to stop >> people making mistakes. Just because something is possible and >> everyone else does it doesn't make something less stupid. >> >> It's a similar principle with wifi/bluetooth, which is why I avoid >> connecting even to a family member's wifi access point unless it's >> absolutely necessary. > > I think the fact that you avoid connecting to WiFi access points, > even ones owned by family members, unless absolutely necessary, may > demonstrate that your model of what does and does not constitute > a ordinary user behavior might not be the same as other > people's. Most people do use WiFi in a variety of places, and most > people do charge off of USB ports they have not personally vetted. > > Given this, I think fixing bugs that might lead to privilege > escalation, even if they require physical connection of USB devices, > does indeed seem reasonable. Yep, my behaviour with these things I'd say is quite unusual compared to most people's. But I wouldn't say I'm particularly paranoid. By the way my reasons for not trusting wifi access points in general is not because I'm worried about wifi protocols. I'm worried about what might be running on the never-been-updated access point from doesnt-really-care-after-its-shipped manufacturer, that's been connected to the internet for a long time, with a root password of london1982 or such like, and a web interface listening on the wan port. Combined with the fact I don't fully trust my handset's ability to defend itself while connected to said access point, due to its difficult to keep up-to-date OS and heavily locked down firmware. I feel somewhat safer connecting with my laptop. But that's all veering far off topic. What I do find very interesting is the question of what is CVE-worthy, particularly with regards to USB flaws in the kernel. The wider question of should the CVE process be driven, to whatever extent, by most people's behaviour, even if that behaviour is ill-advised for whatever reason (simply unaware of/don't care about the risks in most cases). By the way, I'm not arguing that people should not put any effort into fixing these issues, I believe a flaw is always worth fixing, nothing is too trivial to submit a patch to a kernel mailing list for. Rest my case :-)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.