Critical Security Update for usbguard: Addressing CVE-2019-25058
Summary
RHSA-2023:0303: Red Hat Security Advisory: usbguard security update. Affects usbguard versions < 0:1.0.0-10.el9_1.2. Fixed in 0:1.0.0-10.el9_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
usbguard is a software framework designed to protect USB devices on Linux systems by allowing users to define policies for USB device access. It provides a way to manage and control USB devices, ensuring that only authorized devices can connect to the system. This package is essential for maintaining system security, especially in environments where USB devices are frequently used. However, a vulnerability has been identified that could potentially allow unauthorized access to the system via USB devices.
Vulnerability Detail
The vulnerability, identified as CVE-2019-25058, originates from improper handling of USB device permissions within the usbguard package. This flaw could allow an attacker to bypass security measures and gain unauthorized access to the system through malicious USB devices. The ramifications of this vulnerability are significant, as it could lead to data breaches, unauthorized data manipulation, or even complete system compromise. The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
How To Fix
Minimum fixed version
0:1.0.0-10.el9_1.2
This is the first release that contains the fix.
sudo dnf update usbguardTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable USB access until the package is updated. This can be achieved by executing the command:
sudo systemctl stop usbguard.service' to stop the usbguard service
However, this is not a permanent solution and should only be used until the update is applied.
Conclusion
In summary, the usbguard package has a critical vulnerability (CVE-2019-25058) that can lead to unauthorized access through USB devices. It is crucial to update the package to the latest patched version to mitigate this risk. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for usbguard →
FAQ
CVE-2019-25058 is a vulnerability in the usbguard package that allows unauthorized access to the system via USB devices.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
If you cannot update the package immediately, consider disabling USB access as a temporary workaround.
More information about usbguard can be found in its official documentation or on the Red Hat security advisory page.
Related vulnerabilities
Recent vulnerabilities recorded for usbguard.
