CVE-2019-25058
📋 TL;DR
CVE-2019-25058 is a privilege escalation vulnerability in USBGuard versions before 1.1.0 where the usbguard-dbus daemon allows unprivileged users to modify USB device authorization policies. This enables attackers to bypass USB device restrictions and allow all USB devices to connect. Systems running USBGuard with the DBus daemon enabled are affected.
💻 Affected Systems
- USBGuard
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Usbguard by Usbguard Project
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local user access could disable all USB security controls, allowing malicious USB devices (like rubber duckies or BadUSB) to execute arbitrary code, exfiltrate data, or establish persistence.
Likely Case
Malicious insider or compromised user account bypasses USB device whitelisting to connect unauthorized storage devices or input devices for data theft or command injection.
If Mitigated
With proper access controls and monitoring, impact is limited to policy modification without immediate device connection if physical USB ports are restricted.
🎯 Exploit Status
Exploit requires local user access but is simple to execute via DBus calls. Proof of concept exists in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0 and later
Vendor Advisory: https://github.com/USBGuard/usbguard/releases/tag/v1.1.0
Restart Required: Yes
Instructions:
1. Update USBGuard to version 1.1.0 or later using your distribution's package manager. 2. Restart the usbguard-dbus service. 3. Verify the policy database is intact.
🔧 Temporary Workarounds
Disable usbguard-dbus daemon
linuxStop and disable the vulnerable DBus service while maintaining USBGuard protection via CLI
sudo systemctl stop usbguard-dbus
sudo systemctl disable usbguard-dbus
Restrict DBus policy access
linuxModify DBus policy to restrict access to USBGuard interfaces
sudo cp /usr/share/dbus-1/system.d/org.usbguard1.conf /etc/dbus-1/system.d/
Edit /etc/dbus-1/system.d/org.usbguard1.conf to restrict access to root only
🧯 If You Can't Patch
- Disable usbguard-dbus service immediately and use USBGuard CLI only
- Implement strict access controls to prevent unauthorized users from accessing systems with USBGuard
🔍 How to Verify
Check if Vulnerable:
Check USBGuard version and if usbguard-dbus is running: usbguard --version && systemctl status usbguard-dbusCheck Version:
usbguard --versionVerify Fix Applied:
Verify version is 1.1.0 or later: usbguard --version | grep -q '1\.1\.' && echo 'Patched'📡 Detection & Monitoring
Log Indicators:
- DBus policy modification attempts in journalctl
- USBGuard policy changes from non-root users
- Unexpected USB device authorization events
Network Indicators:
- None - local exploitation only
SIEM Query:
process.name="dbus-daemon" AND event.action="method_call" AND dbus.destination="org.usbguard1" AND user.name!="root"🔗 References
- https://github.com/USBGuard/usbguard/issues/273
- https://github.com/USBGuard/usbguard/issues/403
- https://github.com/USBGuard/usbguard/pull/531
- https://lists.debian.org/debian-lts-announce/2022/04/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2ET6DU4IA64M6TMQ4X3SG2L6TRPLDN6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3HQVTHHJFQLSWSXA7W3ZHRF72YMPI46/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4QO5J5YEWVX27QXYOGL3BDRV3KXNRQI/
- https://github.com/USBGuard/usbguard/issues/273
- https://github.com/USBGuard/usbguard/issues/403
- https://github.com/USBGuard/usbguard/pull/531
- https://lists.debian.org/debian-lts-announce/2022/04/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2ET6DU4IA64M6TMQ4X3SG2L6TRPLDN6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3HQVTHHJFQLSWSXA7W3ZHRF72YMPI46/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4QO5J5YEWVX27QXYOGL3BDRV3KXNRQI/
