linux-kernel - Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wmky7i3l.fsf@kernel.org>
Date: Sat, 03 Aug 2024 00:03:26 +0300
From: Kalle Valo <kvalo@...nel.org>
To: Mark Esler <mark.esler@...onical.com>
Cc: color Ice <wirelessdonghack@...il.com>,  stf_xl@...pl,
  linux-wireless@...r.kernel.org,  linux-kernel@...r.kernel.org,
    Greg KH <gregkh@...uxfoundation.org>
Subject: Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer
 Dereference&Use-After-Free Vulnerability

Mark Esler <mark.esler@...onical.com> writes:

> On Fri, Aug 02, 2024 at 03:57:47PM +0800, color Ice wrote:
>> Dear RT2X00 driver maintainers,
>> 
>> We have discovered a critical vulnerability in the RT2X00 driver. We
>> recommend urgently submitting an update.
>> 
>> *Vulnerability Description*: When a PC is running Ubuntu 22.04 or 24.04,
>> executing our proof of concept (POC) can directly cause a null pointer
>> dereference or use-after-free (UAF). The systems we tested were:
>> 
>>    - *Description*: Ubuntu 22.04.4 LTS *Release*: 22.04
>>    - *Description*: Ubuntu 24.04 LTS *Release*: 24.04
>> 
>> We tested network cards from the RT2870/RT3070/RT5370 series, which all
>> belong to the RT2X00 driver group, and all were able to trigger the
>> vulnerability. Additionally, executing the POC requires only user-level
>> privileges. Debian systems are not affected.
>
> It is unclear if Ubuntu is the only affected distro.

It's also unclear how this works as there's no description about the
issue. I'm not going to run any scripts and I don't know how python
usb.core package works. I guess it needs root privileges to be able to
send these USB commands?

If this really is a security vulnerability, here are the instructions
how to report them:

https://docs.kernel.org/process/security-bugs.html

Also adding Greg.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches