Remote code execution in NetBSD USB network interface drivers



Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID N/A
CWE-ID CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
 NetBSD
Operating systems & Components / Operating system

Vendor NetBSD Foundation, Inc

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU47625

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: N/A

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary errors within multiple USB network interface drivers. A remote attacker can send specially crafted data to the network interface, trigger memory corruption and crash the system or execute arbitrary code.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.

The affected USB network interfaces are:

  • atu(4)
  • axe(4)
  • axen(4)
  • otus(4)
  • run(4)
  • ure(4)

* netbsd-8

The following drivers are vulnerable in netbsd-8:

  • atu(4) [fixed in netbsd-8 if_atu.c 1.55.8.4 2020-08-28]
  • axe(4) [fixed in netbsd-8 if_axe.c 1.82.6.5 2020-08-28]
  • axen(4) [fixed in netbsd-8 if_axen.c 1.11.8.9 2020-08-28]
  • otus(4) [fixed in netbsd-8 if_otus.c 1.31.2.3 2020-06-16]
  • run(4) [fixed in netbsd-8 if_run.c 1.22.2.3 2020-06-16]

The following drivers were audited and do not appear to be affected in
netbsd-8:

  • athn(4) - drops packets larger than MCLBYTES
  • aue(4) - transfers only up to AUE_BUFSZ=1536 bytes
  • bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
  • cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
  • cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
  • kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
  • rum(4) - transfers only up to MCLBYTES
  • smsc(4) - drops packets larger than MCLBYTES
  • udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
  • upgt(4) - transfers only up to MCLBYTES
  • upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
  • ural(4) - transfers only up to MCLBYTES
  • ure(4) - no ure(4) in netbsd-8; only added in netbsd-9
  • url(4) - transfers only up to URL_BUFSIZ=1535 bytes
  • urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
  • urtw(4) - transfers only up to MCLBYTES
  • urtwn(4) - drops packets larger than MCLBYTES
  • zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)

* netbsd-9

The following drivers are vulnerable in netbsd-9:

  • atu(4) [fixed in netbsd-9 if_atu.c 1.65.2.1 2020-08-28]
  • axe(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]
  • axen(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]
  • otus(4) [fixed in netbsd-9 if_otus.c 1.38.2.1 2020-06-11]
  • run(4) [fixed in netbsd-9 if_run.c 1.32.4.1 2020-06-11]
  • ure(4) [fixed in netbsd-9 usbnet.c 1.25.2.5 2020-08-28]

The following drivers were audited and do not appear to be affected in
netbsd-9:

  • athn(4) - drops packets larger than MCLBYTES
  • ue(4) - transfers only up to AUE_BUFSZ=1536 bytes
  • bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
  • cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
  • cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
  • kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
  • mue(4) - drops packets larger than MCLBYTES
  • rum(4) - transfers only up to MCLBYTES
  • smsc(4) - drops packets larger than MCLBYTES
  • udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
  • umb(4) - uses m_devget rather than just MCLGET
  • upgt(4) - transfers only up to MCLBYTES
  • upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
  • ural(4) - transfers only up to MCLBYTES
  • url(4) - transfers only up to URL_BUFSIZ=1535 bytes
  • urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
  • urtw(4) - transfers only up to MCLBYTES
  • urtwn(4) - drops packets larger than MCLBYTES
  • zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)

* HEAD

The following drivers are vulnerable in HEAD:

  • atu(4) [fixed in if_atu.c 1.73 2020-08-28]
  • axe(4) [fixed in usbnet.c 1.39 2020-08-28]
  • axen(4) [fixed in usbnet.c 1.39 2020-08-28]
  • otus(4) [fixed in if_otus.c 1.45 2020-06-11]
  • run(4) [fixed in if_run.c 1.41 2020-06-11]
  • ure(4) [fixed in usbnet.c 1.39 2020-08-28]

The following drivers were audited and do not appear to be affected in
HEAD:

  • athn(4) - drops packets larger than MCLBYTES
  • aue(4) - transfers only up to AUE_BUFSZ=1536 bytes
  • bwfm(4) - transfers only up to BWFM_RXBUFSZ=1600 bytes
  • cdce(4) - transfers only up to CDCE_BUFSZ=1542 bytes
  • cue(4) - transfers only up to CUE_BUFSZ=1536 bytes
  • kue(4) - transfers only up to KUE_BUFSZ=1536 bytes
  • mue(4) - drops packets larger than MCLBYTES
  • rum(4) - transfers only up to MCLBYTES
  • smsc(4) - drops packets larger than MCLBYTES
  • udav(4) - transfers only up to UDAV_BUFSZ=UDAV_MAX_MTU=1536 bytes
  • umb(4) - uses m_devget rather than just MCLGET
  • upgt(4) - transfers only up to MCLBYTES
  • upl(4) - transfers only up to UPL_BUFSZ=1024 bytes
  • ural(4) - transfers only up to MCLBYTES
  • url(4) - transfers only up to URL_BUFSIZ=1535 bytes
  • urndis(4) - transfers only up to RNDIS_BUFSZ=1562 bytes
  • urtw(4) - transfers only up to MCLBYTES
  • urtwn(4) - drops packets larger than MCLBYTES
  • zyd(4) - transfers only up to MCLBYTES (plus header and trailer, not in mbuf)

 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

NetBSD: 8.0 - 9.0

CPE2.3 External links

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2020-003.txt.asc


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###