0

I am looking for more information regarding Linux drivers and security vulnerabilities.

As I monitor vulnerability alerts I regularly see Ubuntu security notices like this one: https://ubuntu.com/security/notices/USN-5544-1

It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679)

If my system has an Atheros wireless device I assume I am vulnerable. How about if my system does not have a Atheros wireless device? Could an attacker still interact with the driver software and exploit the vulnerability?

Also how can I see which drivers an attacker would have access to?

Thank you!

2
  • Will there be "local attackers" on your machine at all?
    – U. Windl
    Aug 19, 2022 at 0:08
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Aug 19, 2022 at 0:09

1 Answer 1

0

We can't know. Read the cve specified. Don't assume, it's specified there.

However, it's unlikely a system without a matching atheros card would have the ath9k driver loaded, so it's not clear what you propose should be exploited.

Generally, as an end user reading these security announcements is pretty meaningless. All an end user can do is keep their system up to date, anyways. So enabling security updates is what the end-user should do. Exposing them to such lists would give them an unwarranted amount of alarm:

"did not properly handle some error conditions, leading to a use-after-free vulnerability" does really not specify which error condition, under which external conditions that would be possible, and what kind of control the local attacker needs. Plus, can you explain what the use-after-free vulnerability in the driver allows an attacker to do here, exactly? It only says some memory is used after it's been freed (kudos if you can explain what that means - you're far above an average end user if you can). No information on whether the rest of the system can be groomed to do anything more nefarious than crash the driver is given!

You'll need to understand the cve to make a qualified assessment on whether this affects you at all! For example, the vulnerability is only that a local user, i.e. some program already running on your computer (probably as your user, which other user would execute untrustworthy software?) might cause your wireless driver to crash. Oh no! What a terrible scenario on a device with a wireless card, which probably is not a public server with hundreds of users! Compared to say, that program doing what it's allowed to do anyways without that vulnerability and snorkeling off your data to the Internet.

(The real danger is that this gets exploited by some server daemon that itself had a vulnerability allowing a remote attacker to control what said daemon does, and not crashing the driver but escalating the privilege of the daemon process. But that needs a vulnerable daemon and an actual privilege escalation exploit for this bug, which at this point is still speculative, but presented in the Ubuntu security advisory as equally likely as the crash; i.e., you should not infer anything from the short description, you will always have to go and read the full original description wherever it was posted, just like I just did. The priority is "medium" according to Ubuntu which definitely means "no acute action needed from the end users".)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .