Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2

[John Haxby <john.haxby () oracle com>]

> On 22 Aug 2019, at 18:57, Perry E. Metzger <perry () piermont com> wrote:
>
> > Are these [null pointer deref] even realistic?   If I'm going to leave malicious
> > USB devices in the parking lot for mischief am I going to rely
> > on the unknown victim running a Linux distro with the
> > requisite kernel modules or am I going to just drop a cheap
> > and near-universal USB killer?
>
> Android phones run Linux. People routinely plug those phones in to USB
> charging stations in airports, on airplanes, at booths in public
> places, etc.

If I'm going to attack random devices I'm not going to do it with some random driver that may or may not be present on 
a phone.  And as this is a null pointer reference we're talking about you plug the phone and and it reboots so you 
won't do that more than once.   That's it, that's the limit of the vulnerability.

If I'm going to go to the trouble of emulating a device so I can sneak it into a public charging point I'm not going to 
do it just to make a phone reboot.  I'm going to pick a UAF vulnerability with an exploit that actually does something 
useful, something beyond just making the phone reboot.

Either that or I'm going to sneak in a USB killer and destroy the phones.

No matter what, emulating a device just to cause a null dereference is not CVE worthy.   If it is, then we need a CVE 
for power buttons on laptops and phones.

jch