kernel: information leak bug caused by a malicious USB device in the drivers/net/can/usb/peak_usb/pcan_usb_core.c driver

An information-leak flaw was found in the Linux kernel's pcan USB driver. When a device using this driver connects to the system, the stack information is leaked to the CAN bus, a controller area network for automobiles. The highest threat with this vulnerability is breach of data confidentiality...

kernel: race condition caused by a malicious USB device in the USB character device driver layer

A flaw was found in the Linux kernel, where there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer. An attacker who can hotplug at least two devices of this class can cause a use-after-free situation...

kernel: use-after-free caused by a malicious USB device in the drivers/usb/misc/adutux.c driver

A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module. The attacker must be able to access either of...

kernel: null pointer dereference in drivers/media/usb/zr364xx/zr364xx.c driver

A vulnerability was found in the Linux kernel. The Zr364xx USB device driver is susceptible to malicious USB devices. An attacker able to add a specific USB device could cause a crash leading to a denial of service...

kernel: a malicious USB device in the drivers/input/ff-memless.c leads to use-after-free

A use-after-free flaw was found in the Linux kernel’s input device driver functionality when unplugging a device. A user with physical access could use this flaw to crash the system...

kernel: use-after-free caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver

A use-after-free flaw was found in the acmprobe USB subsystem in the Linux kernel. A race condition occurs when a destroy procedure is initiated allowing the refcount to decrement on the interface so early that it is never under counted. A malicious USB device is required for exploit. System...

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf4096' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process,...

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf4096' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process,...

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf4096' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process,...

QEMU: usb: out-of-bounds r/w access issue while processing usb packets

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while processing USB packets from a guest when USBDevice 'setuplen' exceeds its 'databuf4096' in the dotokenin, dotokenout routines. This flaw allows a guest user to crash the QEMU process,...

The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB which allows user-assisted attackers to execute arbitrary programs via crafted USB data as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.

...

UBUNTU-CVE-2020-25084

QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usbpacketmap return value is not checked...

Google Android Denial of Service Vulnerability (CNVD-2021-30160)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA.Framework is an Android framework component.System is a system component.Broadcom Bluetooth is a Bluetooth component.Wi-Fi is a wireless Internet component.USB driver is a Universal Serial Bus USB...

Unspecified Vulnerability in Google Android (CNVD-2021-30163)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA.Framework is an Android framework component.System is a system component.Broadcom Bluetooth is a Bluetooth component.Wi-Fi is a wireless Internet component.USB driver is a Universal Serial Bus USB...

QEMU buffer overflow vulnerability

QEMU Quick Emulator is a set of simulation processor software by French software developer Fabrice Bellard. The software is fast, cross-platform and other characteristics. A buffer overflow vulnerability exists in QEMU's USB emulator that originates when a networked system or product performs an...

USN-4465-1 linux-hwe, linux-aws-5.3, linux-azure-5.3, linux-gke-5.3 vulnerabilities

It was discovered that the XFS file system implementation in the Linux kernel did not properly validate meta data in some circumstances. An attacker could use this to construct a malicious XFS image that, when mounted, could cause a denial of service. CVE-2020-12655 It was discovered that the...

CVE-2020-15137

All versions of HoRNDIS are affected by an integer overflow in the RNDIS packet parsing routines. A malicious USB device can trigger disclosure of unrelated kernel memory to userspace applications on the host, or can cause the kernel to crash. Kernel memory disclosure is especially likely on 32-b...

UBUNTU-CVE-2020-0256

In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when inserting a malicious USB device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

kernel: use-after-free caused by a malicious USB device in the drivers/hid/usbhid/hiddev.c driver

A vulnerability was found in hiddevopen in drivers/hid/usbhid/hiddev.c in the USB Human Interface Device class subsystem, where an existing device must be validated prior to its access. The device should also ensure the hiddevlist cleanup occurs at failure, as this may lead to a use-after-free...

The vulnerability of the USB 2.0 controller EHCI in VMware ESXi, VMware Workstation, and VMware Fusion allows a attacker to execute arbitrary code.

The vulnerability of the USB 2.0 controller EHCI in VMware ESXi, VMware Workstation, and VMware Fusion stems from synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability allows an attacker to execute arbitrary code...