Exploiting USB on a Tesla IVI with Raspberry Pi Devices to B...

src/SUMMARY.md

@@ -983,6 +983,7 @@
 - [Adreno A7xx Sds Rb Priv Bypass Gpu Smmu Kernel Rw](binary-exploitation/linux-kernel-exploitation/adreno-a7xx-sds-rb-priv-bypass-gpu-smmu-kernel-rw.md)
 - [Af Unix Msg Oob Uaf Skb Primitives](binary-exploitation/linux-kernel-exploitation/af-unix-msg-oob-uaf-skb-primitives.md)
 - [Arm64 Static Linear Map Kaslr Bypass](binary-exploitation/linux-kernel-exploitation/arm64-static-linear-map-kaslr-bypass.md)
+- [Linux USB Audio Descriptor OOB Reads to KASLR Leaks](binary-exploitation/linux-kernel-exploitation/usb-audio-descriptor-oob-kaslr-leak.md)
 - [Futex PI UAF to Pipe Physical R/W and Workqueue Execution](binary-exploitation/linux-kernel-exploitation/futex-pi-uaf-pipe-buffer-workqueue-usermodehelper.md)
 - [Ksmbd Streams Xattr Oob Write Cve 2025 37947](binary-exploitation/linux-kernel-exploitation/ksmbd-streams_xattr-oob-write-cve-2025-37947.md)
 - [Pixel Bigwave Bigo Job Timeout Uaf Kernel Write](binary-exploitation/linux-kernel-exploitation/pixel-bigwave-bigo-job-timeout-uaf-kernel-write.md)

src/binary-exploitation/linux-kernel-exploitation/usb-audio-descriptor-oob-kaslr-leak.md

@@ -0,0 +1,74 @@
+# Linux USB Audio Descriptor OOB Reads to KASLR Leaks
+
+{{#include ../../banners/hacktricks-training.md}}
+
+A programmable USB peripheral can exploit a host-side descriptor parser without any userland foothold. The useful pattern is to shape kernel allocations through normal device enumeration, make a malformed descriptor walk into an adjacent object, and turn the host's subsequent USB requests into an information-disclosure channel. NCC Group demonstrated this pattern against a Linux-based vehicle IVI using CVE-2024-53150 and multiple coordinated USB devices.<sup>[[2]](#references)[[3]](#references)</sup>
+
+This is an **address-disclosure stage**, not a complete compromise: a leaked code pointer can remove KASLR uncertainty for a separate corruption primitive, while a heap pointer only reveals heap layout unless it can be related to the randomized kernel image.<sup>[[2]](#references)[[3]](#references)</sup>
+
+## Descriptor-length bug
+
+The affected ALSA USB-audio traversal in `sound/usb/clock.c` searched UAC2/UAC3 clock source, selector, and multiplier descriptors without first proving that each descriptor's `bLength` covered every field later accessed. Clock selectors are especially important because their variable-length `baCSourceID[]` array contains `bNrInPins` entries followed by protocol-specific tail fields. A short descriptor with a large attacker-controlled pin count therefore made `__uac_clock_find_source()` consume bytes beyond the declared descriptor as additional clock entity IDs.<sup>[[1]](#references)[[2]](#references)</sup>
+
+The demonstrated parser path required a sufficiently valid UAC2/UAC3 topology—audio descriptors including input/output terminals, an AS header, and a format descriptor—before the malformed clock selector was reached.<sup>[[2]](#references)</sup>
+
+## Turning traversal into a selector-ID oracle
+
+The peripheral does not receive an unrestricted raw memory dump. Instead, attacker-supplied clock selectors form a **lookup table**: when an out-of-bounds byte equals the entity ID of one of those selectors, the host finds that entity and emits a USB control request for it. The malicious device observes the requested selector ID in its control-request callback, converting descriptor traversal into a conditional byte-disclosure oracle.<sup>[[2]](#references)</sup>
+
+A practical extraction workflow is:<sup>[[2]](#references)</sup>
+
+1. Populate the descriptor buffer with clock selectors whose IDs cover the candidate byte values. The number that fits depends on the `kmalloc` cache selected for that descriptor allocation.
+2. Put the malformed selector last and set `bNrInPins` to `255`; its position controls how far the source-ID walk extends beyond the valid buffer.
+3. Reserve an uninteresting selector ID as padding so the out-of-bounds window stays small. If all candidates do not fit, partition the ID range and repeat against stable adjacent data.
+4. Record the IDs observed in host control requests. A selector is not requested more than once in one traversal, so this first pass yields a set and repeated bytes remain ambiguous.
+5. Repeat using only the observed IDs. The resulting requests follow traversal order, allowing the bytes in the leak window to be ordered. Infer fixed/aligned bytes where possible to reduce collisions and duplicate-value ambiguity.
+
+This oracle is more constrained than an arbitrary read: reliability depends on a stable adjacent object, candidate coverage, non-repeating bytes, and the ability to replay enumeration without changing the target value.<sup>[[2]](#references)</sup>
+
+## USB-only kernel heap grooming
+
+Physical peripheral attacks cannot assume access to local spray interfaces such as `ioctl()`. Instead, enumerate devices whose drivers create many objects in the **same slab cache** as the vulnerable descriptor buffer; the public demonstration targeted `kmalloc-512`. Useful sprayers either allocate repeatedly inside a USB driver path or store attacker-sized descriptor data in a large kernel allocation. For a KASLR leak, seek a sprayed object whose first field is a kernel function pointer so it begins immediately after the vulnerable chunk.<sup>[[2]](#references)</sup>
+
+The physical grooming loop is:<sup>[[2]](#references)[[3]](#references)</sup>
+
+1. Attach several sprayer devices through hubs to fill the target cache.
+2. Attach one or more malicious USB-audio devices so a vulnerable chunk may land immediately before a sprayed pointer-bearing object.
+3. Trigger the selector oracle and validate whether the expected pointer bytes appeared.
+4. If adjacency failed, programmatically detach the devices and retry with a different sprayer/leaker ratio.
+
+Because connection order, driver lifetime, and hub capacity affect allocation order, separate devices are useful for **spray**, **trigger**, and **exfiltration** roles. NCC Group's DUET design coordinates Raspberry Pi Pico boards using TinyUSB, a Python/C manager, Wi-Fi control, physical hubs, programmable insertion/removal, and a bidirectional channel for control-request results. The published material describes the framework architecture but does not provide a public source repository or directly runnable exploit.<sup>[[2]](#references)[[3]](#references)</sup>
+
+## From pointer disclosure to KASLR bypass
+
+Once the reconstructed value is a pointer into a known kernel code object, calculate the runtime base from the corresponding link-time symbol in the **exact target build**:
+
+```text
+runtime_kernel_base = leaked_pointer - (symbol_link_address - vmlinux_link_base)
+```
+
+Validate candidates using expected canonical address bits, alignment, and nearby known bytes before consuming the result in a later exploit stage. A disclosed slab address is still valuable for heap-layout work, but it is not by itself proof of the kernel text base. The demonstrated chain stopped at the information-disclosure/KASLR primitive and did not establish a kernel write, control-flow hijack, or code execution.<sup>[[2]](#references)[[3]](#references)</sup>
+
+## Patch and audit points
+
+The upstream repair adds minimum-length checks to source and multiplier descriptors. For selectors, it also verifies the variable array and tail: `sizeof(selector) + bNrInPins + 4 + 2` for UAC3, or `sizeof(selector) + bNrInPins + 1 + 1` for UAC2. Invalid short descriptors are skipped rather than cast and traversed.<sup>[[1]](#references)</sup>
+
+```c
+if (!DESC_LENGTH_CHECK(cs, proto))
+    return false;
+if (GET_VAL(cs, proto, bClockID) != id)
+    return false;
+if (proto == UAC_VERSION_3)
+    return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + 4 + 2;
+return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + 1 + 1;
+```
+
+When auditing an embedded image, check whether `CONFIG_SND_USB_AUDIO` is enabled and verify that its vendor kernel contains upstream commit `a3dd4d63eeb4` or an equivalent backport; a nominal kernel version alone is insufficient because embedded trees frequently carry selective fixes.<sup>[[1]](#references)[[2]](#references)</sup>
+
+## References
+
+- [1] [Linux upstream fix - ALSA: usb-audio: Fix out of bounds reads when finding clock sources](https://github.com/torvalds/linux/commit/a3dd4d63eeb452cfb064a13862fb376ab108f6a6)
+- [2] [Exploiting USB on a Tesla IVI with Raspberry Pi Devices to bypass KASLR - presentation slides](https://nccgroup.com/media/xvinlas5/exploiting-usb-insomnihack-2026-1.pdf)
+- [3] [Exploiting USB on a Tesla IVI with Raspberry Pi Devices to Bypass KASLR](https://nccgroup.com/research/exploiting-usb-on-a-tesla-ivi-with-raspberry-pi-devices-to-bypass-kaslr-insomnihack-2026)
+
+{{#include ../../banners/hacktricks-training.md}}

src/hardware-physical-access/physical-attacks.md

@@ -75,6 +75,12 @@ On an unencrypted or already-unlocked Windows volume, an offline environment can
 
 Devices such as **USB Rubber Ducky** and Teensy boards can enumerate as trusted HID keyboards and inject predefined keystrokes. The payload initially has the privileges and desktop access of the logged-on session; UAC prompts, screen locking, keyboard layout, timing, and endpoint USB policy still constrain it.<sup>[[15]](#references)</sup>
 
+Programmable peripherals can also attack host kernel parsers and coordinate several USB devices for heap grooming and information disclosure:
+
+{{#ref}}
+../binary-exploitation/linux-kernel-exploitation/usb-audio-descriptor-oob-kaslr-leak.md
+{{#endref}}
+
 ### Volume Shadow Copy
 
 Administrator or backup privileges can create a shadow copy or save registry hives so locked files such as **SAM** and **SYSTEM** can be acquired. This is a post-compromise collection technique, not a privilege bypass, and should be correlated with `diskshadow`/VSS and registry-hive export events.