0

Have the Linux USB drivers been patched for the recent vulnerabilities that have been found by Andrey Konovalov (Google)? If not what can be done to protect against these attacks other than avoiding use of USB devices?

  • There's a complete list of these vulnerabilities here. Quite a large amount of them have been fixed according to this list. – MoonRunestar Nov 17 '17 at 9:25
  • @Sonickyle27 So the 14 new vulnerabilities have not been patched yet, if I am correct. – ng.newbie Nov 17 '17 at 9:27
  • Only denial of service vulnerabilities have been released, code execution haven't. In any case don't stick unknown stuff in your computer (holds for more than just computers though). – rustyx Nov 17 '17 at 12:47
2

You can check yourself. Choose a random CVE - I chose CVE-2017-16538. It states -

drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service...

Now have a look at that file history in the repository -

https://github.com/torvalds/linux/commits/master/drivers/media/usb/dvb-usb-v2/lmedm04.c

Aug 20, 2017 media: rc: rename RC_TYPE_* to RC_PROTO_* and RC_BIT_* to RC_PROTO_BIT_*
Jun 24, 2017 media: dvb-usb-v2: lmedm04: remove unnecessary variable in lme2510_st…

So no - it doesn't look like that one has been fixed. As /u/Sonickyle27 showed many of them do have fixes but it looks like they haven't been accepted and merged yet.

Saying this there is technically the possibility distributions may have patched it themselves.

  • How would I know whether the distribution that I am running has the vulnerability or not ? I am asking because you clearly stated that fixes are available but they are not merged yet. – ng.newbie Nov 17 '17 at 9:32
  • @ng.newbie - if its not critical and its not merged into the main kernel yet then the chance of a distribution taking its own action is extremely slim. If you want to know for certain then you'd either have to check your own distributions source (and that your system is fully patched / rebooted since they were applied) or test for the vulnerabilities yourself. – Hector Nov 17 '17 at 9:35
  • @ng.newbie - Most of these on top of only being known about for a couple of weeks also rely on malicious devices (i.e the device itself - not just whats stored on it). So unless you are state actor level (in which case you really shouldn't plug any device into your system unless you know the full manufacturer chain) the chances of someone handling you a device designed to exploit this in the immediate is close to zero. – Hector Nov 17 '17 at 9:38
  • tell me something are these vulnerabilities marked as non-critical ? it shows a CVSS Base Score as 7.2 High. – ng.newbie Nov 17 '17 at 9:38
  • @ng.newbie - Without looking at each and every one I can't answer that. If you want that level of detail go and do it yourself! Many have already been fixed. The fact that these require physical access and most lead to something like Denial of Service etc. have me at the view they are not close to critical. – Hector Nov 17 '17 at 9:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.