Achieving Linux Kernel Code Execution Through a Malicious USB Device

A Black Hat Europe 2021 talk about exploiting a double-free in the USB MIDI driver over USB. The exploit works against devices with writable code section. By Martijn Bogaard and Dana Geist.

This is the first Linux-kernel-host-code-execution-over-USB exploit known to me.

The exploit is based on the bug I found a few years ago. However, my exploit required cooperating userspace, so it didn't really count. Happy to see a purely USB one!

Exploiting a USB host from the device side is hard due to limited control: the device can only respond to host's requests. You can't simply start sending messages for heap shaping, etc. You need to find a way to make the kernel ask for those.