In FreeBSD A vulnerability in the USB stack (CVE-2020-7456) allows for code execution at the kernel or user space level when connecting a malicious USB device to the system. USB Human Interface Device (HID) descriptors can place and retrieve the current state, allowing for the combination of element descriptions into multi-level groups. FreeBSD supports up to 4 such levels of retrieval. If the level was not restored when processing the same HID element, an access to an incorrect memory area occurs. The issue has been resolved in updates FreeBSD 11.3-RELEASE-p10 and 12.1-RELEASE-p6. As a workaround, it is recommended to set the parameter "sysctl hw.usb.disable_enumeration=1."
The vulnerability was discovered by Andy Nguyen from Google and does not overlap with another issue recently. Researchers from Purdue University and the École Polytechnique Fédérale de Lausanne. These researchers developed a USBFuzz toolkit that simulates an improperly functioning USB device for fuzz testing USB drivers. USBFuzz is expected to be released soon Using this new tool, 26 vulnerabilities were identified, 18 in Linux, 4 in Windows, 3 in macOS, and one in FreeBSD. Details about these issues are not being disclosed yet, only that 10 vulnerabilities have received CVE identifiers, and 11 problems manifesting in Linux have already been fixed. A similar fuzzing testing technique Andrey Konovalov from Google, who has investigated the USB stack in Linux over the past few years. In FreeBSD, a vulnerability in the USB stack (CVE-2020-7456) has been resolved, allowing for organized code execution.
Source: opennet.ru
