Google Project Zero: high severity USB vulnerability in Chrome OS

Topic

New Reply

https://bugs.chromium.org/p/project-zero/issues/detail?id=2264&can=2&q=&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary&cells=ids

ChromeOS’ usage of usbguard is bypassable

VULNERABILITY DETAILS
ChromeOS uses https://usbguard.github.io/ when the screen is locked (but not on the login screen, perhaps because it is expected that code execution is much less helpful when the disk is still encrypted?)…

2022-02-24 issue triaged by Chromium (as Severity-Low)

Note that this issue is that a mitigation doesn’t work; this is not exploitable on its own, but it exposes extra attack surface to USB devices that are inserted while the screen is locked.

[Moderator edit] edited for readability

Reply | Quote

Replies

Contrary to the title of this thread, the severity is rated low by Chromium. It requires physical access, special hardware and does not (yet) have an exploit.

cheers, Paul

Reply | Quote

Paul T wrote:

does not (yet) have an exploit.

Now after the publication there will be.

Reply | Quote

Still need physical access and special hardware. Severity still = low.

cheers, Paul

1 user thanked author for this post.

Alex5723

Reply | Quote