Skip to main content

Linux USB Subsystem Vulnerabilities

Fourteen vulnerabilities have been found to be affecting the USB subsystem on Linux. The vulnerabilities affect all Linux devices with USB ports. However, physical access is required to initiate them.
Threat ID:
CC-1777
Category:
Exploit
Threat Severity:
Low
Threat Vector:
Published:
14 November 2017 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Fourteen vulnerabilities have been found to be affecting the USB subsystem on Linux. The vulnerabilities affect all Linux devices with USB ports. However, physical access is required to initiate them.

Affected platforms

The following platforms are known to be affected:

Android

  • Linux systems with USB ports
  • Linux kernel versions 4.13.4 to 4.14.10 including Android devices

Threat details

The attacker uses a kernel fuzzing tool loaded onto malicious USB device, which sends a large volume of random code targeted at a specific piece of software in order to cause it to crash and to exploit the vulnerabilities. Most of the vulnerabilities allow the attacker to initiate a denial-of-service (DoS) attack via physical USB access to the targeted device, however, a few can be exploited to execute malicious code on the device.

Remediation steps

Type Step
  • Ensure that unauthorised persons are not able to gain physical access to a building.
  • Educate users on best-practice security processes when dealing with USB devices. This includes untrusted USB devices that may have been found as well as trusted USB devices that have been connected to untrusted devices.
  • Upgrade to Linux version 4.14.11

Last edited: 17 February 2020 11:33 am