Linux Peripheral CVE Study

Repo structure

• /data_tables: CVE data sheet of 6 common peripheral protocols.

• /kernel-exploits: Scripts and setting for configuring kernel compilation.

• /scripts: Python scripts used to generate plots for CVEs.

• /CVE_Visualization_Report.pdf: Plots and figures in visualization of CVE type distribution.

Results

1. Memory bugs are the most common bug type in linux peripheral protocol stack. Among all memory bugs, null pointer deference and use-after-free composes the major bug type.

2. Particular protocol layers are more error-prone. Taken most widely used USB protocol as example.

Acknowledgment

This project is partially supported by National Center for Transporation Cyber Security and Resiliency (TraCR)