Thursday, April 18, 2024

Multiple Denial of Service Vulnerabilities Discovered in Linux kernel USB Subsystem

Multiple vulnerabilities found in Linux USB drivers that included with Linux kernel USB subsystem. It can be triggered by an attacker who has a physical access to the machine.

These bugs allow attackers to induce a denial of service and to insert malicious scripts or to escalate privileges if they get physical access.

All the vulnerabilities are discovered by Google Security expert Andrey Konovalov and they have been reported to Linux Community. He found 79 kernel bugs and only 14 reported now.

CVEs – Linux USB

According to Finding Report, Below are the details for 14 vulnerabilities found with syzkaller in the Linux kernel USB subsystem. All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine.

CVE-2017-16525 
CVE-2017-16526
CVE-2017-16527
CVE-2017-16528
CVE-2017-16529
CVE-2017-16530
CVE-2017-16531
CVE-2017-16532
CVE-2017-16533
CVE-2017-16534
CVE-2017-16535
CVE-2017-16536
CVE-2017-16537
CVE-2017-16538

These vulnerabilities found using syzkaller a Google fuzzing tools that support for akaros, freebsd, fuchsia, netbsd, and windows are supported to varying degrees.

Also Read Linux Exploit Suggester – A Kali Linux Tool to Find the Linux OS Kernel Exploits

Syzkaller detects a kernel crash and it will automatically start the process of reproducing this crash and then minimize the program that caused it. To download syzkaller.

Tools to Harden Linux Security

Lynis a famous open source security auditing tool designed to audit and harden Unix and Linux based systems. It scans the system by performing many security control checks. For more detailed explanation on Lynis.

After the scan, a report will be displayed with all discovered findings.Lynis assists auditors in performing Basel II, GLBA, HIPAA, PCI DSS and SOX (Sarbanes-Oxley) compliance audits.

Researchers from the University of London present POTUS tool which automatically finding vulnerabilities in USB device drivers for Linux system.It is capable of detecting zero-days. They found and confirmed two previously undiscovered zero-days in the mainline Linux kernel with POTUS tool.

Website

Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

WAAP/WAF ROI Analysis

Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles