Re: Linux kernel: multiple vulnerabilities in the USB subsystem x2

[Kurt H Maier <khm () sciops net>]

On Thu, Aug 22, 2019 at 07:17:34PM +0100, John Haxby wrote:
> If I'm going to attack random devices I'm not going to do it with some random driver that may or may not be present 
> on a phone.  And as this is a null pointer reference we're talking about you plug the phone and and it reboots so you 
> won't do that more than once.   That's it, that's the limit of the vulnerability.
>
> If I'm going to go to the trouble of emulating a device so I can sneak it into a public charging point I'm not going 
> to do it just to make a phone reboot.  I'm going to pick a UAF vulnerability with an exploit that actually does 
> something useful, something beyond just making the phone reboot.
>
> Either that or I'm going to sneak in a USB killer and destroy the phones.
>
> No matter what, emulating a device just to cause a null dereference is not CVE worthy.   If it is, then we need a CVE 
> for power buttons on laptops and phones.
>
> jch

Undisclosed impromptu power buttons are absolutely a concern, regardless
of your personal pen-testing preferences.

khm