Andrei Konovalov from Google 15 vulnerabilities in USB drivers offered in the Linux kernel. This is the second batch of issues found during fuzzing tests — back in 2017, this researcher found an additional 14 vulnerabilities in the USB stack. These issues could potentially be exploited by connecting specially crafted USB devices to a computer. An attack is possible with physical access to the hardware and could at least lead to kernel crashes, though other manifestations are not ruled out (for example, for a similar vulnerability identified in 2016 in the snd-usbmidi USB driver, it was possible to execute code at the kernel level).
Out of the 15 issues, 13 have already been fixed in the current updates of the Linux kernel, but two vulnerabilities (CVE-2019-15290, CVE-2019-15291) remain unpatched in the latest release 5.2.9. The unpatched vulnerabilities could lead to a NULL pointer dereference in the ath6kl and b2c2 drivers when receiving incorrect data from a device. Other vulnerabilities include:
- Use-after-free memory accesses in the v4l2-dev/radio-raremono, dvb-usb, sound/core, cpia2, and p54usb drivers;
- Double-free issues in the rio500 driver;
- NULL pointer dereferences in the yurex, zr364xx, siano/smsusb, sisusbvga, line6/pcm, motu_microbookii, and line6 drivers.
Source: opennet.ru
