linux-kernel - Re: [PATCH] usb-storage: Add Brain USB3-FW to IGNORE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 2 Mar 2024 20:19:10 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: Lars Melin <larsm17@...il.com>
Cc: Alan Stern <stern@...land.harvard.edu>, Tom Hu <huxiaoying@...inos.cn>,
	linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
	usb-storage@...ts.one-eyed-alien.net
Subject: Re: [PATCH] usb-storage: Add Brain USB3-FW to IGNORE_UAS

On Sat, Mar 02, 2024 at 07:06:20PM +0700, Lars Melin wrote:
> On 2024-03-01 23:53, Alan Stern wrote:
> > >   drivers/usb/storage/unusual_uas.h | 7 +++++++
> > >   1 file changed, 7 insertions(+)
> > > 
> > > diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
> > > index 1f8c9b16a0fb..98b7ff2c76ba 100644
> > > --- a/drivers/usb/storage/unusual_uas.h
> > > +++ b/drivers/usb/storage/unusual_uas.h
> > > @@ -83,6 +83,13 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
> > >   		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
> > >   		US_FL_NO_REPORT_LUNS),
> > > +/* Reported-by: Tom Hu <huxiaoying@...inos.cn> */
> > > +UNUSUAL_DEV(0x1234, 0x1234, 0x0000, 0x9999,
> > 
> > The vendor and product ID values have a suspicious look, but they appear
> > to be genuine.
> 
> Hi Alan,
> it is of course a bogus Id, here is another one:
> 
> "SmartWi - Multi Room Solution is a Smart Card Reader hardware device. This
> driver was developed by SmartWi International A/S. The hardware id of this
> driver is USB/VID_1234&PID_1234."
> 
> found by googling vid_1234&pid_1234.
> 
> There are others like 1234:5678 which also looks suspicious.

Yeah, this is a "fake" number, which happens a lot (0000/0000 is also
used.)

Because of this, I don't know if we should take this change.  It
obviously fixes an issue for _this_ device, but for any other
usb-storage device using this fake id, will it cause issues?

thanks,

greg k-h