linux-kernel - USB Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <40dfa45b-5f21-4eef-a8c1-51a2f320e267@rowland.harvard.edu>
Date: Tue, 11 Jun 2024 10:35:12 -0400
From: Alan Stern <stern@...land.harvard.edu>
To: Greg KH <gregkh@...uxfoundation.org>, Oliver Neukum <oneukum@...e.com>
Cc: USB mailing list <linux-usb@...r.kernel.org>,
  Kernel development list <linux-kernel@...r.kernel.org>
Subject: USB Denial Of Service

Greg, Oliver, or anyone else:

Questions:

If a broken or malicious device causes a USB class driver to add a 
thousand (or more) error messages per second to the kernel log, 
indefinitely, would that be considered a form of DOS?

Should the driver be fixed?

What is an acceptable rate for an unending stream of error messages?  
Once a second?  Once a minute?

At what point should the driver give up and stop trying to communicate 
with the device?

(These are not moot questions.  There are indeed drivers, and probably 
not just in the USB subsystem, subject to this sort of behavior.)

Alan Stern