From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Kalle Valo" <kvalo@kernel.org>,
"Oleksij Rempel" <linux@rempel-privat.de>,
"Maciej Żenczykowski" <maze@google.com>,
"Neil Armstrong" <neil.armstrong@linaro.org>,
"Mauro Carvalho Chehab" <mchehab@kernel.org>,
"Andrzej Pietrasiewicz" <andrzejtp2010@gmail.com>,
"Jacopo Mondi" <jacopo@jmondi.org>,
"Łukasz Stelmach" <l.stelmach@samsung.com>,
"Laurent Pinchart" <laurent.pinchart@ideasonboard.com>,
linux-usb@vger.kernel.org, netdev@vger.kernel.org,
linux-wireless@vger.kernel.org,
"Ilja Van Sprundel" <ivansprundel@ioactive.com>,
"Joseph Tartaro" <joseph.tartaro@ioactive.com>
Subject: [PATCH] USB: disable all RNDIS protocol drivers
Date: Wed, 23 Nov 2022 13:46:20 +0100 [thread overview]
Message-ID: <20221123124620.1387499-1-gregkh@linuxfoundation.org> (raw)
The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on
any system that uses it with untrusted hosts or devices. Because the
protocol is impossible to make secure, just disable all rndis drivers to
prevent anyone from using them again.
Windows only needed this for XP and newer systems, Windows systems older
than that can use the normal USB class protocols instead, which do not
have these problems.
Android has had this disabled for many years so there should not be any
real systems that still need this.
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Kalle Valo <kvalo@kernel.org>
Cc: Oleksij Rempel <linux@rempel-privat.de>
Cc: "Maciej Żenczykowski" <maze@google.com>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Andrzej Pietrasiewicz <andrzejtp2010@gmail.com>
Cc: Jacopo Mondi <jacopo@jmondi.org>
Cc: "Łukasz Stelmach" <l.stelmach@samsung.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: linux-usb@vger.kernel.org
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-wireless@vger.kernel.org
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Reported-by: Joseph Tartaro <joseph.tartaro@ioactive.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Note, I'll submit patches removing the individual drivers for later, but
that is more complex as unwinding the interaction between the CDC
networking and RNDIS drivers is tricky. For now, let's just disable all
of this code as it is not secure.
I can take this through the USB tree if the networking maintainers have
no objection. I thought I had done this months ago, when the last round
of "there are bugs in the protocol!" reports happened at the end of
2021, but forgot to do so, my fault.
drivers/net/usb/Kconfig | 1 +
drivers/net/wireless/Kconfig | 1 +
drivers/usb/gadget/Kconfig | 4 +---
drivers/usb/gadget/legacy/Kconfig | 3 +++
4 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 4402eedb3d1a..83f9c0632642 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -401,6 +401,7 @@ config USB_NET_MCS7830
config USB_NET_RNDIS_HOST
tristate "Host for RNDIS and ActiveSync devices"
depends on USB_USBNET
+ depends on BROKEN
select USB_NET_CDCETHER
help
This option enables hosting "Remote NDIS" USB networking links,
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index cb1c15012dd0..f162b25123d7 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -81,6 +81,7 @@ config USB_NET_RNDIS_WLAN
tristate "Wireless RNDIS USB support"
depends on USB
depends on CFG80211
+ depends on BROKEN
select USB_NET_DRIVERS
select USB_USBNET
select USB_NET_CDCETHER
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 4fa2ddf322b4..2c99d4313064 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -183,9 +183,6 @@ config USB_F_EEM
config USB_F_SUBSET
tristate
-config USB_F_RNDIS
- tristate
-
config USB_F_MASS_STORAGE
tristate
@@ -297,6 +294,7 @@ config USB_CONFIGFS_RNDIS
bool "RNDIS"
depends on USB_CONFIGFS
depends on NET
+ depends on BROKEN
select USB_U_ETHER
select USB_F_RNDIS
help
diff --git a/drivers/usb/gadget/legacy/Kconfig b/drivers/usb/gadget/legacy/Kconfig
index 0a7b382fbe27..03d6da63edf7 100644
--- a/drivers/usb/gadget/legacy/Kconfig
+++ b/drivers/usb/gadget/legacy/Kconfig
@@ -153,6 +153,7 @@ config USB_ETH
config USB_ETH_RNDIS
bool "RNDIS support"
depends on USB_ETH
+ depends on BROKEN
select USB_LIBCOMPOSITE
select USB_F_RNDIS
default y
@@ -247,6 +248,7 @@ config USB_FUNCTIONFS_ETH
config USB_FUNCTIONFS_RNDIS
bool "Include configuration with RNDIS (Ethernet)"
depends on USB_FUNCTIONFS && NET
+ depends on BROKEN
select USB_U_ETHER
select USB_F_RNDIS
help
@@ -427,6 +429,7 @@ config USB_G_MULTI
config USB_G_MULTI_RNDIS
bool "RNDIS + CDC Serial + Storage configuration"
depends on USB_G_MULTI
+ depends on BROKEN
select USB_F_RNDIS
default y
help
--
2.38.1
next reply other threads:[~2022-11-23 13:09 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-23 12:46 Greg Kroah-Hartman [this message]
2022-11-23 14:20 ` [PATCH] USB: disable all RNDIS protocol drivers Johannes Berg
2022-11-23 15:05 ` Greg Kroah-Hartman
2022-11-23 16:27 ` Johannes Berg
2023-01-10 22:47 ` James Hilliard
2022-11-23 15:21 ` Kalle Valo
2022-11-23 18:29 ` Jakub Kicinski
2022-11-23 20:27 ` Maciej Żenczykowski
2023-01-11 13:38 ` Jan Engelhardt
2023-01-11 14:56 ` Greg Kroah-Hartman
2023-07-03 21:11 ` Enrico Mioso
2023-07-04 6:47 ` Greg Kroah-Hartman
2023-07-12 9:22 ` Oliver Neukum
2023-07-12 13:00 ` Johannes Berg
2023-07-12 16:39 ` Greg Kroah-Hartman
2023-07-13 0:28 ` Johannes Berg
2023-07-13 5:34 ` Greg Kroah-Hartman
2023-07-13 8:33 ` Oliver Neukum
2023-07-13 9:49 ` Maciej Żenczykowski
2023-07-13 12:21 ` Johannes Berg
2023-07-13 5:21 ` Mauro Carvalho Chehab
2022-11-23 15:40 Nicolas Cavallari
2022-11-23 15:55 ` Greg Kroah-Hartman
2022-11-24 0:58 ` Lars Melin
2022-11-29 22:48 ` Dan Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221123124620.1387499-1-gregkh@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andrzejtp2010@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=ivansprundel@ioactive.com \
--cc=jacopo@jmondi.org \
--cc=joseph.tartaro@ioactive.com \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=l.stelmach@samsung.com \
--cc=laurent.pinchart@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linux@rempel-privat.de \
--cc=maze@google.com \
--cc=mchehab@kernel.org \
--cc=neil.armstrong@linaro.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.