5 ms·
Apparently, these are all denial of service attacks using a specially crafted USB device that you have to physically insert into the Linux machine. Pulling the
by fauigerzigerk 9y ago
Apparently, these are all denial of service attacks using a specially crafted USB device that you have to physically insert into the Linux machine.
Pulling the plug sounds easier :)
- digi_owl 9y agohttps://wicg.github.io/webusb/ https://wicg.github.io/webusb/
- fauigerzigerk 9y agoCare to elaborate?
- geofft 9y agoI don't think that's relevant - WebUSB exposes physical USB devices on the local machine to code running inside the browser. It does not allow code running inside the browser to access the host USB stack as if it were a physical device (in order to emulate a USB device, forward one across the web, etc.).
- staticassertion 9y agoIt's unclear whether or not these are all strictly DOS. Some seem like they may be exploitable.
- greenhouse_gas 9y agoI thought that it would help even if the USB stack _would_ be secure, as any USB device has direct access to the motherboard/PCI?
- cjbprime 9y agoIt sounds like you're thinking that any device connected to the motherboard or PCI bus has access to read/write arbitrary memory on the host through Direct Memory Access or some other mechanism. This isn't true for a couple reasons: * The PCI bus access is given to the _USB hub_, since that's what's connected to PCI, not to the USB device you plugged in. The USB hub can talk to the USB device using whatever restrictive protocol it wants to. The USB protocol doesn't give DMA access to devices -- it polls registers on the devices for commands and data. * Even if it were a hostile device connected to the PCI bus, modern machines, both desktop-class (e.g. x64) and mobile (e.g. modern ARM cores in cellphones) use IOMMUs to give a virtual view of just the device's own addressable memory to the device, not the full system memory map. (I might be mistaken about some of this, but that's my understanding.)
- justincormack 9y agoMost machines have IOMMUs but they are often not enabled. A lot of them are fairly buggy. Linux generally does not enable them, not sure if osx or Windows does by default.
- pepve 9y agoConsider the bugs a workaround for laptops with a fixed battery. ;-)
- geofft 9y agoA specially-crafted USB device doesn't have to look specially-crafted - a malicious cheap USB charger or cable from Amazon or from your local convenience store could be specially-crafted, too.
- fauigerzigerk 9y agoSure, but if the attacker has physical access to the machine, I don't see many scenarios in which launching a USB denial of service attack would be the most effective thing to do. Perhaps if the goal was to sabotage a presentation or some 007 style attack... In any event, I didn't mean to say that the vulnerability is not worth fixing. It definitely is. It just seems like a relatively benign issue compared to the daily barrage of hair raising security flaws.
- staticassertion 9y ago> I don't see many scenarios in which launching a USB denial of service attack would be the most effective thing to do. High security servers that don't have typical interfaces are super common in government facilities. Sometimes they'll shove glue into the USB and sometimes the USB is the only method of accessing the system.
- cjbprime 9y agoAs 'staticassertion replied above, causing a kernel crash due to memory mismanagement is usually a sign that with some extra work you could cause execution of arbitrary code in the kernel instead.