Date: Fri, 25 Oct 2019 20:09:01 +0200 From: Andrey Konovalov <andreyknvl@...il.com> To: oss-security@...ts.openwall.com Cc: mathias.payer@...elwelt.net, Hui Peng <benquike@...il.com> Subject: Do distros want to see CVEs for Linux kernel USB bugs? Hi! As we keep getting more USB bugs reported by syzbot , I'd like to figure out what to do with those in regards to CVEs. Last time I requested a bunch of CVEs for USB bugs, there was a long discussion about whether that is the right thing to do, see the full thread here . I don't want to argue now whether CVEs are useful for the upstream Linux kernel. My question is: with CVEs as they work today, do Linux distros want to see CVEs filed for Linux kernel bugs that are triggerable by a malicious USB device? Since not all USB bugs are the same, let's bucket them into: 1. Different kinds of DoS (e.g. null-ptr-deref). 2. Info / uninitialized memory leaks. 3. Bugs that lead to arbitrary code execution. 4. Non-triaged memory corruptions (UAF/OOB). Points 1-3 refer to the bugs that have been assessed for the impact that they cause, while point 4 refers to the bugs that haven't been looked at closely. Keep in mind that: 1. Most of the time physical access to the USB port is required to trigger these bugs. 2. Sometimes, in cases of e.g. exposed USB/IP or USBAnywhere like vulnerabilities  these bugs can be triggered remotely. Thanks!  https://syzkaller.appspot.com/upstream?manager=ci2-upstream-usb  https://www.openwall.com/lists/oss-security/2019/08/20/2  https://github.com/eclypsium/USBAnywhere
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.