Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1384144

Re: stable-security kernel updates

From Bjørn Mork <bjorn@mork.no>
Newsgroups linux.kernel
Subject Re: stable-security kernel updates
Date 2016-04-21 14:30 +0200
Message-ID <rqlU6-EL-5@gated-at.bofh.it> (permalink)
References <rq6s1-4Jb-5@gated-at.bofh.it> <rqgB4-4Cj-13@gated-at.bofh.it> <rqkOm-8hw-9@gated-at.bofh.it>
Organization m

Show all headers | View raw

Sasha Levin <sasha.levin@oracle.com> writes:
> On 04/21/2016 02:43 AM, Jiri Slaby wrote:
>
>> Input: powermate - fix oops with malicious USB descriptors
>
> This requires physical access to the machine.

You wish.

Say you have some internal USB connected device with replacable
firmware.  LTE modem, fingerprint reader, webcam - you name it. How do
you know that this cannot be abused to impersonate some other USB
device?  Yes, changing the firmware of those devices should of course
require admin privileges.  But is that always so?  Writing firmware to a
modem, for example, is typically done over a serial device similar to
the one used for normal modem operations. Privileges necessary to manage
the modem will also include changing the firmware. Physical access is
not necessary.

Do you trust the firmware protection of all your non-removable USB
devices?


Bjørn

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-20 22:00 +0200
  Re: stable-security kernel updates Jiri Slaby <jslaby@suse.cz> - 2016-04-21 08:50 +0200
    Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 09:20 +0200
      Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 13:30 +0200
        Re: stable-security kernel updates Greg KH <greg@kroah.com> - 2016-04-21 14:40 +0200
          Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 16:10 +0200
            Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 16:20 +0200
    Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 13:20 +0200
      Re: stable-security kernel updates Jiri Slaby <jslaby@suse.cz> - 2016-04-21 14:10 +0200
        Re: stable-security kernel updates Greg KH <greg@kroah.com> - 2016-04-21 14:40 +0200
          Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 15:00 +0200
          Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 16:00 +0200
            Re: stable-security kernel updates Jiri Slaby <jslaby@suse.cz> - 2016-04-21 16:20 +0200
              Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 16:20 +0200
              Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 16:30 +0200
                Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 16:40 +0200
                Re: stable-security kernel updates Ben Hutchings <ben@decadent.org.uk> - 2016-04-26 01:20 +0200
                Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-26 06:50 +0200
      Re: stable-security kernel updates Jiri Slaby <jslaby@suse.cz> - 2016-04-21 14:10 +0200
        Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 16:00 +0200
          Re: stable-security kernel updates Jiri Slaby <jslaby@suse.cz> - 2016-04-21 17:00 +0200
            Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 18:00 +0200
            Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 21:40 +0200
      Re: stable-security kernel updates Bjørn Mork <bjorn@mork.no> - 2016-04-21 14:30 +0200
  Re: stable-security kernel updates Willy Tarreau <w@1wt.eu> - 2016-04-21 15:00 +0200
    Re: stable-security kernel updates Sasha Levin <sasha.levin@oracle.com> - 2016-04-21 16:20 +0200

csiph-web