from Google report on the identification of 15 new vulnerabilities (CVE-2019-19523 — CVE-2019-19537) in USB drivers provided in the Linux kernel. This is the third batch of issues discovered during fuzz testing of the USB stack in the package — earlier, this researcher reported 29 vulnerabilities.
This time, the list includes only vulnerabilities caused by accessing already freed memory areas (use-after-free) or leading to data leaks from kernel memory. Issues that can be used for denial of service are not included in the report. The vulnerabilities could potentially be exploited when specially prepared USB devices are connected to the computer. Fixes for all problems mentioned in the report have already been included in the kernel, but some not included in the report remain unpatched.
The most dangerous vulnerabilities of the ‘use-after-free’ class that can lead to the execution of attacker code have been fixed in the adutux, ff-memless, ieee802154, pn533, hiddev, iowarrior, mcba_usb, and yurex drivers. Under CVE-2019-19532, an additional 14 vulnerabilities in HID drivers caused by out-of-bounds write errors have been recorded. Problems leading to data leaks from kernel memory have been found in the ttusb_dec, pcan_usb_fd, and pcan_usb_pro drivers. In the USB stack code for handling character devices, an issue (CVE-2019-19537) caused by a race condition has been identified.
It is also worth noting
four vulnerabilities (CVE-2019-14895, CVE-2019-14896, CVE-2019-14897, CVE-2019-14901) in the driver for Marvell wireless chips, which could lead to a buffer overflow. The attack can be carried out remotely by sending specially crafted frames when connecting to an attacker's wireless access point. The most likely threat noted is a remote denial of service (kernel crash), but the possibility of code execution in the system cannot be ruled out.
Source: opennet.ru
