On Saturday 22 January 2005 5:33 pm, Mark Williamson wrote: > > Then my second question was about the USB stack integrity (no specific > > to a linux platform) Do you think that devices could create an overflow > > in order to take control/install a software in the computer ? > > In terms of DMAing to buffers, the only device you have to trust to play nice > is your host controller. The host controller does the DMA on behalf on an > actual USB device attached to it, so (unless the host controller is buggy) > attempts to transfer too much data should just result in an error. > > Obviously, you do have to trust your host controller to behave well (as is > really true for anything that can DMA to memory without restriction).
That's what I was going to point out, thanks. Though though I hope you meant that first paragraph to focus on the notion that the host controller's DRIVER could have bugs ... and the second to point out the usual point that the HARDWARE must be correctly implemented too. I've never heard of any bugs in USB hardware that could be exploited in the way that various Pentium CPU bugs could be exploited, FWIW. That analysis extends neatly: the hardware must behave correctly, so must the drivers that touch it (HCDs), so must the software that touches those drivers (usbcore and USB device drivers), and the software they talk to (e.g. network stack, SCSI stack, filesystem code, ...) and so on all the way up to the userspace/kernelspace boundary. > It's not inconceivable in principle that there'd be a software bug at a > higher > layer (in the client driver or possibly the USB core) that a device could > exploit. How often these actually occur (if at all) is another matter ;-) Or in the IRQ handling infrastrucure, the interaction of the DMA mapping code with the memory management code, how drivers expect cpu scheduling to act ... or basically any other kernel code. An OS kernel (like Linux) is a complex beast, and there WILL be bugs. Any of them COULD in principle lead -- directly, but far more usually indirectly -- to a behavior that could open the door to that grey zone that's sometimes called "security related bugs". > > (what hapen when the devices are not respecting the protocol ? ) > > A device that misbehaves can cause some disruption but they are reasonably > (as > hardware goes) well fenced off. Under some circumstances, a misbehaving > device may have its port disabled entirely. That is, there's nothing especially dangerous in USB per se. - Dave > HTH, > Mark > > > ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ linux-usb-devel@lists.sourceforge.net To unsubscribe, use the last form field at: https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
