Re: Ubuntu RT2X00 WIFI USB Driver Kernel NULL pointer Dereference&Use-After-Free Vulnerability

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Aug 06, 2024 at 11:54:33AM +0800, LidongLI wrote:
> 
> Hi Ted,
> 
> Thank you for your detailed response.
> 
> An attacker doesn't need to create a udev rule in the user's path because that isn't feasible. We need to consider scenarios where certain special devices (embedded systems) are designed from the outset with RT2X00 wireless network cards included in the udev rules. This is because they need to perform custom or automated functions related to the embedded system's operations.
> 
> Therefore, what I want to emphasize is that while this vulnerability may not affect users who do not have udev rules configured, setting udev rules is not inherently insecure. It is a normal configuration. Without udev rules, USB devices cannot be properly invoked or perform additional functions under certain conditions. It's a necessary feature.
> 
> However, for users utilizing RT2X00 drivers with this normal configuration, it directly allows the execution of the script without sudo, leading to a system crash. This indicates that the RT2X00 driver itself has a vulnerability that needs to be addressed. A robust and secure kernel and driver should not crash or dereference a null pointer regardless of the script run or the permissions used. We tested other drivers and did not encounter similar issues.
> 
> I believe this issue should be considered from two aspects:
> 
> 1.The vulnerability indeed requires certain conditions to be triggered, but the configuration required is normal and necessary.

No, the configuration is not normal or necessary at all, there is no
such default udev rule, or system configuration that allows what you
have found to be triggered by a normal user without root permissions.

If you think there is a bug in the kernel here, wonderful, please submit
a kernel patch to resolve the issue and we will be glad to review it.

I don't have time to look into this until next week due to travel, so
unless someone else picks it up before then, nothing new is going to
happen on it.

thanks,

greg k-h