Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 Oct 2019 20:09:01 +0200
From: Andrey Konovalov <>
Cc:, Hui Peng <>
Subject: Do distros want to see CVEs for Linux kernel USB bugs?


As we keep getting more USB bugs reported by syzbot [1], I'd like to
figure out what to do with those in regards to CVEs. Last time I
requested a bunch of CVEs for USB bugs, there was a long discussion
about whether that is the right thing to do, see the full thread here

I don't want to argue now whether CVEs are useful for the upstream
Linux kernel. My question is: with CVEs as they work today, do Linux
distros want to see CVEs filed for Linux kernel bugs that are
triggerable by a malicious USB device?

Since not all USB bugs are the same, let's bucket them into:

1. Different kinds of DoS (e.g. null-ptr-deref).
2. Info / uninitialized memory leaks.
3. Bugs that lead to arbitrary code execution.
4. Non-triaged memory corruptions (UAF/OOB).

Points 1-3 refer to the bugs that have been assessed for the impact
that they cause, while point 4 refers to the bugs that haven't been
looked at closely.

Keep in mind that:

1. Most of the time physical access to the USB port is required to
trigger these bugs.
2. Sometimes, in cases of e.g. exposed USB/IP or USBAnywhere like
vulnerabilities [3] these bugs can be triggered remotely.





Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.