Multiple vulnerabilities found in Linux USB drivers that included with Linux kernel USB subsystem. It can be triggered by an attacker who has a physical access to the machine.
These bugs allow attackers to induce a denial of service and to insert malicious scripts or to escalate privileges if they get physical access.
All the vulnerabilities are discovered by Google Security expert Andrey Konovalov and they have been reported to Linux Community. He found 79 kernel bugs and only 14 reported now.
According to Finding Report, Below are the details for 14 vulnerabilities found with syzkaller in the Linux kernel USB subsystem. All of them can be triggered with a crafted malicious USB device in case an attacker has physical access to the machine.
CVE-2017-16525 CVE-2017-16526 CVE-2017-16527 CVE-2017-16528 CVE-2017-16529 CVE-2017-16530 CVE-2017-16531 CVE-2017-16532 CVE-2017-16533 CVE-2017-16534 CVE-2017-16535 CVE-2017-16536 CVE-2017-16537 CVE-2017-16538
These vulnerabilities found using syzkaller a Google fuzzing tools that support for akaros, freebsd, fuchsia, netbsd, and windows are supported to varying degrees.
Also Read Linux Exploit Suggester – A Kali Linux Tool to Find the Linux OS Kernel Exploits
Syzkaller detects a kernel crash and it will automatically start the process of reproducing this crash and then minimize the program that caused it. To download syzkaller.
Lynis a famous open source security auditing tool designed to audit and harden Unix and Linux based systems. It scans the system by performing many security control checks. For more detailed explanation on Lynis.
After the scan, a report will be displayed with all discovered findings.Lynis assists auditors in performing Basel II, GLBA, HIPAA, PCI DSS and SOX (Sarbanes-Oxley) compliance audits.
Researchers from the University of London present POTUS tool which automatically finding vulnerabilities in USB device drivers for Linux system.It is capable of detecting zero-days. They found and confirmed two previously undiscovered zero-days in the mainline Linux kernel with POTUS tool.
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…
Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated cybercriminals to achieve its strategic goals,…