linux-kernel - Re: [PATCH v2] usb: serial: Repair FTDI FT232R bricked eeprom

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 10 Sep 2020 12:33:55 +0700
From:   Lars Melin <larsm17@...il.com>
To:     Oliver Neukum <oneukum@...e.de>,
        James Hilliard <james.hilliard1@...il.com>,
        linux-usb@...r.kernel.org
Cc:     Johan Hovold <johan@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org, Russ Dill <Russ.Dill@...il.com>,
        Hector Martin <hector@...cansoft.com>
Subject: Re: [PATCH v2] usb: serial: Repair FTDI FT232R bricked eeprom

On 9/10/2020 10:02, Oliver Neukum wrote:
> Am Mittwoch, den 09.09.2020, 13:34 -0600 schrieb James Hilliard:
>> This patch detects and reverses the effects of the malicious FTDI
>> Windows driver version 2.12.00(FTDIgate).
> 
> Hi,
> 
> this raises questions.
> Should we do this unconditionally without asking?
> Does this belong into kernel space?
> 

My answer to both of those question is a strong NO.

The patch author tries to justify the patch with egoistical arguments 
(easier for him and his customers) without thinking of all other users 
of memory constrained embedded hardware that doesn't need the patch code 
but have to carry it.

The bricked PID is btw already supported by the linux ftdi driver so 
there is no functionality gain in the patch.

br
Lars