Have the Linux USB drivers been patched for the recent vulnerabilities that have been found by Andrey Konovalov (Google)? If not what can be done to protect against these attacks other than avoiding use of USB devices?
-
There's a complete list of these vulnerabilities here. Quite a large amount of them have been fixed according to this list.– user84120Nov 17, 2017 at 9:25
-
@Sonickyle27 So the 14 new vulnerabilities have not been patched yet, if I am correct.– ng.newbieNov 17, 2017 at 9:27
-
Only denial of service vulnerabilities have been released, code execution haven't. In any case don't stick unknown stuff in your computer (holds for more than just computers though).– rustyxNov 17, 2017 at 12:47
Add a comment
|
1 Answer
You can check yourself. Choose a random CVE - I chose CVE-2017-16538. It states -
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service...
Now have a look at that file history in the repository -
https://github.com/torvalds/linux/commits/master/drivers/media/usb/dvb-usb-v2/lmedm04.c
Aug 20, 2017 media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_*
Jun 24, 2017 media: dvb-usb-v2: lmedm04: remove unnecessary variable in lme2510_st…
So no - it doesn't look like that one has been fixed. As /u/Sonickyle27 showed many of them do have fixes but it looks like they haven't been accepted and merged yet.
Saying this there is technically the possibility distributions may have patched it themselves.
-
How would I know whether the distribution that I am running has the vulnerability or not ? I am asking because you clearly stated that fixes are available but they are not merged yet. Nov 17, 2017 at 9:32
-
@ng.newbie - if its not critical and its not merged into the main kernel yet then the chance of a distribution taking its own action is extremely slim. If you want to know for certain then you'd either have to check your own distributions source (and that your system is fully patched / rebooted since they were applied) or test for the vulnerabilities yourself.– HectorNov 17, 2017 at 9:35
-
@ng.newbie - Most of these on top of only being known about for a couple of weeks also rely on malicious devices (i.e the device itself - not just whats stored on it). So unless you are state actor level (in which case you really shouldn't plug any device into your system unless you know the full manufacturer chain) the chances of someone handling you a device designed to exploit this in the immediate is close to zero.– HectorNov 17, 2017 at 9:38
-
tell me something are these vulnerabilities marked as non-critical ? it shows a CVSS Base Score as 7.2 High. Nov 17, 2017 at 9:38
-
@ng.newbie - Without looking at each and every one I can't answer that. If you want that level of detail go and do it yourself! Many have already been fixed. The fact that these require physical access and most lead to something like Denial of Service etc. have me at the view they are not close to critical.– HectorNov 17, 2017 at 9:47