All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: LidongLI <wirelessdonghack@gmail.com>
Cc: kvalo@kernel.org, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, linux-wireless@vger.kernel.org,
	mark.esler@canonical.com, stf_xl@wp.pl
Subject: Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability
Date: Mon, 5 Aug 2024 08:55:10 +0200	[thread overview]
Message-ID: <2024080557-mouse-overload-bb56@gregkh> (raw)
In-Reply-To: <20240805022030.1929100-1-wirelessdonghack@gmail.com>

On Mon, Aug 05, 2024 at 10:20:30AM +0800, LidongLI wrote:
> Hi Greg,
> 
> We tried it, and after configuring the udev rules, I can run the proof of concept (PoC) and reproduce the previous issue without using sudo
> 

What did you do exactly with a new udev rule?  Did you give it userspace
permission to unbind/reset the device?

As it is today, this requires root permissions and it looks to just be a
race with the existing kernel driver setting the device up and userspace
trying to reset the device at the same time, not anything that can
normally happen in a system from what I can tell.

thanks,

greg k-h

  reply	other threads:[~2024-08-05  6:55 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-08-02  7:57 Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability color Ice
2024-08-02  8:19 ` Mark Esler
2024-08-02 21:03   ` Kalle Valo
2024-08-03  5:42     ` color Ice
2024-08-03  6:31     ` Greg KH
2024-08-03  7:57       ` LidongLI
2024-08-05  2:18       ` LidongLI
2024-08-05  2:20       ` LidongLI
2024-08-05  6:55         ` Greg KH [this message]
2024-08-05  8:33       ` LidongLI
2024-08-05 18:33         ` Greg KH
2024-08-05 18:37         ` Greg KH
2024-08-06  1:59       ` LidongLI
2024-08-06  3:06         ` Theodore Ts'o
2024-08-06 13:38         ` Alan Stern
     [not found]           ` <CAOV16XF8cEg7+HAFQiCUrt9-Dp4M+-TANjQqRXH87AAdgzmNMg@mail.gmail.com>
2024-08-06 18:36             ` Alan Stern
2024-08-07  1:56               ` color Ice
2024-08-06  2:34       ` LidongLI
2024-08-06  3:54       ` LidongLI
2024-08-06  6:34         ` Greg KH
2024-08-06  6:35         ` Greg KH
2024-08-06 12:45         ` Theodore Ts'o
2024-08-07  2:11       ` LidongLI
2024-08-14  5:58       ` LidongLI
2024-08-14 14:55         ` Alan Stern
2024-08-19 10:49           ` color Ice
2024-08-19 10:56             ` Greg KH
     [not found]               ` <CAOV16XFYeWdT4tSpLWoE+pCVsNERXKJQCJvJovrfsgMn1PMzbA@mail.gmail.com>
2024-08-19 17:43                 ` Greg KH
2024-08-21  8:25                   ` color Ice
2024-08-21 14:06                     ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2024080557-mouse-overload-bb56@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=kvalo@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=mark.esler@canonical.com \
    --cc=stf_xl@wp.pl \
    --cc=wirelessdonghack@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.