GSD-2022-1002538 usb: dwc2: gadget: don't reset gadget's driver->bus

usb: dwc2: gadget: don't reset gadget's driver-bus This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.4 by commit...

CMC Electronics EFB breakout vulnerability

We’ve been finding vulnerabilities in electronic flight bags for a few years now. Disclosure response from the vendors involved has varied from excellent to radio silence. In every case we have tried extremely hard to engage with the vendors involved, even where we were ignored. We asked friendly...

GSD-2021-1002300 usb: musb: tusb6010: check return value after calling platform_get_resource()

usb: musb: tusb6010: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.82 by commit...

GSD-2021-1002273 usb: musb: tusb6010: check return value after calling platform_get_resource()

usb: musb: tusb6010: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.162 by commit...

UVI-2021-1001633 usb: dwc2: check return value after calling platform_get_resource()

usb: dwc2: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.72 by commit...

GSD-2021-1001527 usb: dwc2: check return value after calling platform_get_resource()

usb: dwc2: check return value after calling platformgetresource This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.250 by commit...

UVI-2021-1001466 usb: max-3421: Prevent corruption of freed memory

usb: max-3421: Prevent corruption of freed memory This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.4.277 by commit...

Authentication flaw

DM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentication and access all features and data on the USB...

GSD-2021-1000954 usb: dwc3: gadget: Bail from dwc3_gadget_exit() if dwc->gadget is NULL

usb: dwc3: gadget: Bail from dwc3gadgetexit if dwc-gadget is NULL This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.44 by commit...

GSD-2021-1000900 usb: fix various gadget panics on 10gbps cabling

usb: fix various gadget panics on 10gbps cabling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.126 by commit...

UVI-2021-1000860 usb: dwc3: ep0: fix NULL pointer exception

usb: dwc3: ep0: fix NULL pointer exception This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.237 by commit...

UVI-2021-1000607 USB: usbfs: Don't WARN about excessively large memory allocations

USB: usbfs: Don't WARN about excessively large memory allocations This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.42 by commit...

GSD-2021-1000098 usb: dwc3: core: Do core softreset when switch mode

usb: dwc3: core: Do core softreset when switch mode This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.20 by commit...

AutoGadgetFS - USB Testing Made Easy

What’s AutoGadgetFS ? AutoGadgetFS is an open source framework that allows users to assess USB devices and their associated hosts/drivers/software without an in-depth knowledge of the USB protocol. The tool is written in Python3 and utilizes RabbitMQ and WiFi access to enable researchers to condu...

Cyber Security Month. What can you do?

October is Cyber Security Month, when organisations like the CISA, the ECSM, and many more promote initiatives to help raise security awareness. Around the world companies are dedicating time to improve staff security awareness, and its a really busy time for us. You may be thinking you’d like to...

CVE-2019-18673

CVE-2019-18673 affects SHIFT BitBox02 devices and describes a side-channel where the power draw of the row-based OLED display varies with the number of illuminated pixels. This enables partial recovery of display contents if an attacker has sufficient control over the device’s USB connection to m...

Capsule Technologies SmartLinx Neuron 2 restricted environment protection mechanism failure vulnerability

Summary A restricted environment escape vulnerability exists in the “kiosk mode” function of Capsule Technologies SmartLinx Neuron 2 medical information collection devices running versions 9.0.3 or lower. A specific series of keyboard inputs can escape the restricted environment, resulting in ful...

Use Safety and Precaution When Using USBs

Removable USB devices are basic instruments for storing and transferring files from one device to another. Although they’re convenient to use, they can also pose a potential threat to your devices—especially when used without prior caution. There are reported instances, where researchers weren’t...

CVE-2019-9019

The British Airways Entertainment System, as installed on Boeing 777-36NER and possibly other aircraft, does not prevent the USB charging/data-transfer feature from interacting with USB keyboard and mouse devices, which allows physically proximate attackers to conduct unanticipated attacks agains...

Google 'Titan Security Key' Is Now On Sale For $50

Google just made its Titan Security Key available on its store for $50. First announced last month at Google Cloud Next '18 convention, Titan Security Key is a tiny USB device—similar to Yubico's YubiKey—that offers hardware-based two-factor authentication 2FA for online accounts with the highest...