This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU47625
Risk: High
CVSSv4.0:
8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID:
N/A
CWE-ID:
CWE-119 - Memory corruption
Exploit availability:
No
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary errors within multiple USB network interface drivers. A remote attacker can send specially crafted data to the network interface, trigger memory corruption and crash the system or execute arbitrary code.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
The affected USB network interfaces are:
- atu(4)
- axe(4)
- axen(4)
- otus(4)
- run(4)
- ure(4)
* netbsd-8
The following drivers are vulnerable in netbsd-8:
- atu(4) [fixed in netbsd-8 if_atu.c 1.55.8.4 2020-08-28]
- axe(4) [fixed in netbsd-8 if_axe.c 1.82.6.5 2020-08-28]
- axen(4) [fixed in netbsd-8 if_axen.c 1.11.8.9 2020-08-28]
- otus(4) [fixed in netbsd-8 if_otus.c 1.31.2.3 2020-06-16]
- run(4) [fixed in netbsd-8 if_run.c 1.22.2.3 2020-06-16]
The following drivers were audited and do not appear to be affected in
netbsd-8:
- athn(4) - drops packets larger than MCLBYTES
- aue(4) - transfers only up to AUE_BUFSZ=1536 bytes
- bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
- cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
- cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
- kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
- rum(4) - transfers only up to MCLBYTES
- smsc(4) - drops packets larger than MCLBYTES
- udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
- upgt(4) - transfers only up to MCLBYTES
- upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
- ural(4) - transfers only up to MCLBYTES
- ure(4) - no ure(4) in netbsd-8; only added in netbsd-9
- url(4) - transfers only up to URL_BUFSIZ=1535 bytes
- urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
- urtw(4) - transfers only up to MCLBYTES
- urtwn(4) - drops packets larger than MCLBYTES
- zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)
* netbsd-9
The following drivers are vulnerable in netbsd-9:
- atu(4) [fixed in netbsd-9 if_atu.c 1.65.2.1 2020-08-28]
- axe(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]
- axen(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]
- otus(4) [fixed in netbsd-9 if_otus.c 1.38.2.1 2020-06-11]
- run(4) [fixed in netbsd-9 if_run.c 1.32.4.1 2020-06-11]
- ure(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]
The following drivers were audited and do not appear to be affected in
netbsd-9:
- athn(4) - drops packets larger than MCLBYTES
- ue(4) - transfers only up to AUE_BUFSZ=1536 bytes
- bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
- cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
- cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
- kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
- mue(4) - drops packets larger than MCLBYTES
- rum(4) - transfers only up to MCLBYTES
- smsc(4) - drops packets larger than MCLBYTES
- udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
- umb(4) - uses m_devget rather than just MCLGET
- upgt(4) - transfers only up to MCLBYTES
- upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
- ural(4) - transfers only up to MCLBYTES
- url(4) - transfers only up to URL_BUFSIZ=1535 bytes
- urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
- urtw(4) - transfers only up to MCLBYTES
- urtwn(4) - drops packets larger than MCLBYTES
- zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)
* HEAD
The following drivers are vulnerable in HEAD:
- atu(4) [fixed in if_atu.c 1.73 2020-08-28]
- axe(4) [fixed in usbnet.c 1.39 2020-08-28]
- axen(4) [fixed in usbnet.c 1.39 2020-08-28]
- otus(4) [fixed in if_otus.c 1.45 2020-06-11]
- run(4) [fixed in if_run.c 1.41 2020-06-11]
- ure(4) [fixed in usbnet.c 1.39 2020-08-28]
The following drivers were audited and do not appear to be affected in
HEAD:
- athn(4) - drops packets larger than MCLBYTES
- aue(4) - transfers only up to AUE_BUFSZ=1536 bytes
- bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
- cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
- cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
- kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
- mue(4) - drops packets larger than MCLBYTES
- rum(4) - transfers only up to MCLBYTES
- smsc(4) - drops packets larger than MCLBYTES
- udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
- umb(4) - uses m_devget rather than just MCLGET
- upgt(4) - transfers only up to MCLBYTES
- upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
- ural(4) - transfers only up to MCLBYTES
- url(4) - transfers only up to URL_BUFSIZ=1535 bytes
- urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
- urtw(4) - transfers only up to MCLBYTES
- urtwn(4) - drops packets larger than MCLBYTES
- zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)
Mitigation
Install updates from vendor's website.
Vulnerable software versions
NetBSD:
8.0 - 9.0
CPE2.3
External links
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2020-003.txt.asc
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.