Out-of-Bounds Write in Usbredir USB Redirection

Executive Summary

This is an out-of-bounds write flaw in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer unsubmitted. This defeats bounds checks in usbredirhost_iso_packet(), allowing a peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking for the usbredir package version and verifying if USB redirection is enabled. Inspect installed packages with commands like 'rpm -qa | grep usbredir' on Red Hat systems or 'dpkg -l | grep usbredir' on Debian-based systems. Monitor logs for unusual memory access errors or crashes in virtualization environments.

Useful 0 Not Useful 0

Impact Analysis

The flaw can lead to memory corruption, potentially enabling unauthorized code execution or causing system crashes. It may impact systems using USB redirection in virtualized environments if mitigation steps are not taken.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability and integrity through memory corruption, which could lead to crashes or unauthorized code execution. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, system instability could indirectly impact compliance by disrupting logging, monitoring, or access controls required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Remove the usbredir package if USB redirection is not required using 'dnf remove usbredir' or 'apt-get remove usbredir'. Disable USB redirection in virtualization platforms like QEMU or libvirt by editing configuration files. Ensure no active isochronous OUT streams with transfer count 1 are running.

Useful 0 Not Useful 0