https://bugzilla.kernel.org/show_bug.cgi?id=216283 --- Comment #7 from Theodore Tso (tytso@xxxxxxx) --- On Tue, Aug 02, 2022 at 08:45:51AM +1000, Dave Chinner wrote: > > On systems that automount filesytsems when you plug in a USB drive > (which most distros do out of the box) then a crash bug during mount > is, at minimum, an annoying DOS vector. And if it can result in a > buffer overflow, then.... You need physical access to plug in a USB drive, and if you can do that, the number of potential attack vectors are numerous. eSATA, Firewire, etc., gives the potential hardware device direct access to the PCI bus and the ability to issue arbitrary DMA requests. Badly implemented Thunderbolt devices can have the same vulnerability, and badly implemented USB controllers have their own entertaining issues. And if attackers have a bit more unguarded physical access time, there are no shortage of "evil maid" attacks that can be carried out. As far as I'm concerned a secure system has automounters disabled, and comptent distributions should disable the automounter when the laptop is locked. Enterprise class server class machines running enterprise distros have no business having the automounter enabled at all, and careful datacenter managers should fill in the USB ports with epoxy. For more common sense tips, see: https://www.youtube.com/watch?v=kd33UVZhnAA Look, bad buys have the time and energy to run file system fuzzers (many of which are open source and can be easily found on github). I'm sure our good friends at the NSA, MSS, and KGB know all of this already; and the NSO group is apparently happy to make them available to anyone willing to pay, no matter what their human rights record might be. Security by obscurity never works, and as far as I am concerned, I am grateful when academics run fuzzers and report bugs to us. Especially since attacks which require physical access or root privs are going to have low CVE Security Scores *anyway*. Cheers, - Ted -- You may reply to this email to add a comment. You are receiving this mail because: You are watching the assignee of the bug.
