from Google report on the discovery of 15 vulnerabilities (CVE-2019-19523 — CVE-2019-19537) in USB drivers provided in the Linux kernel. This is the third batch of issues found during fuzz testing of the USB stack in the package — this researcher 29 vulnerabilities.
This time, the list includes only vulnerabilities caused by accessing already freed memory areas (use-after-free) or leading to data leaks from kernel memory. Problems that can be exploited for denial of service are not included in the report. The vulnerabilities can potentially be exploited when specially crafted USB devices are connected to the computer. Fixes for all issues mentioned in the report have already been included in the kernel, but some excluded from the report remain unfixed.
The most dangerous use-after-free vulnerabilities that could allow an attacker to execute code have been remedied in the drivers adutux, ff-memless, ieee802154, pn533, hiddev, iowarrior, mcba_usb, and yurex. An additional 14 vulnerabilities in HID drivers related to out-of-bounds write errors have been summarized under CVE-2019-19532. Issues leading to data leaks from kernel memory were found in the drivers ttusb_dec, pcan_usb_fd, and pcan_usb_pro. A problem was identified in the USB stack code for working with character devices (CVE-2019-19537), caused by a race condition.
It is also worth noting
four vulnerabilities (CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901) in the driver for Marvell wireless chips, which can lead to buffer overflows. The attack can be executed remotely by sending specially formatted frames when connecting to a malicious access point. The most likely threat is a remote denial of service (kernel crash), but the possibility of code execution in the system cannot be excluded.
Kilde: opennet.ru
