New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 818807 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: prevent WebUSB from accessing all Yubico devices

Reported by c...@yubico.com, Mar 5 2018

Issue description

See  issue 818592  for vulnerability information. Until we gain comfort with any potential solutions to those issues, we'd like all of our devices not to be accessible via WebUSB.

Please prevent all devices with USB VID 0x1050 (Yubico) with any PID from being accessed via WebUSB.
 

Comment 1 by c...@yubico.com, Mar 5 2018

In the interest of expedience, if it's not possible to implement a full VID block quickly, below is a list of all of our PIDs. Please let us know how quickly this can be done and in stable.

0x0010
0x0110
0x0111
0x0112
0x0113
0x0114
0x0115
0x0116
0x0120
0x0200
0x0211
0x0401
0x0402
0x0403
0x0404
0x0405
0x0406
0x0407
0x0410
0x0018
0x0030
Labels: Security_Severity-High Security_Impact-Stable
Owner: reillyg@chromium.org
Status: Assigned (was: Unconfirmed)
Labels to match  issue 818592 
Cc: gov...@chromium.org
Labels: M-66
Cc: abdulsyed@chromium.org
Labels: OS-Linux OS-Mac OS-Windows
Pls add applicable OSs. Thank you.

Comment 5 by kenrb@chromium.org, Mar 5 2018

Components: Blink>USB

Comment 6 by kenrb@chromium.org, Mar 5 2018

Labels: Pri-1
Project Member

Comment 7 by bugdroid1@chromium.org, Mar 5 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/19ef9b1996b53c5a03abe3166ebc08294d840f69

commit 19ef9b1996b53c5a03abe3166ebc08294d840f69
Author: Reilly Grant <reillyg@chromium.org>
Date: Mon Mar 05 23:54:18 2018

Add remaining Yubikey devices to WebUSB blocklist

As requested by Yubico this change adds the rest of their Yubikey
devices to the WebUSB blocklist.

Bug:  818807 
Change-Id: I4755ca0a2558e7efb2449e6b439c2abcc2440611
Reviewed-on: https://chromium-review.googlesource.com/949389
Reviewed-by: Adam Langley <agl@chromium.org>
Commit-Queue: Reilly Grant <reillyg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#540992}
[modify] https://crrev.com/19ef9b1996b53c5a03abe3166ebc08294d840f69/chrome/browser/usb/usb_blocklist.cc
[modify] https://crrev.com/19ef9b1996b53c5a03abe3166ebc08294d840f69/chrome/browser/usb/usb_blocklist_unittest.cc

Labels: OS-Android OS-Chrome
Status: Fixed (was: Assigned)
In addition to the change above (which will be in Chrome 67.0.3363.0) this list is also being rolled out via Finch to Chrome 65 and above.
Project Member

Comment 9 by sheriffbot@chromium.org, Mar 6 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Labels: reward-NA
Project Member

Comment 11 by bugdroid1@chromium.org, Mar 6 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/967d11212c9f2547f7cc27eb96bee08618d4f143

commit 967d11212c9f2547f7cc27eb96bee08618d4f143
Author: Reilly Grant <reillyg@chromium.org>
Date: Tue Mar 06 23:17:54 2018

Add additional U2F tokens to WebUSB blocklist

Additional U2F tokens from other manufacturers.

Bug:  818807 
Change-Id: Ieb20c0b433b00bb3a0b4f65519d9b978b8c81b80
Reviewed-on: https://chromium-review.googlesource.com/952071
Reviewed-by: Adam Langley <agl@chromium.org>
Commit-Queue: Reilly Grant <reillyg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#541235}
[modify] https://crrev.com/967d11212c9f2547f7cc27eb96bee08618d4f143/chrome/browser/usb/usb_blocklist.cc

Project Member

Comment 12 by sheriffbot@chromium.org, Mar 16 2018

Labels: Merge-Request-66
Project Member

Comment 13 by sheriffbot@chromium.org, Mar 16 2018

Labels: -Merge-Request-66 Merge-Review-66 Hotlist-Merge-Review
This bug requires manual review: M66 has already been promoted to the beta branch, so this requires manual review
Please contact the milestone owner if you have questions.
Owners: cmasso@(Android), cmasso@(iOS), josafat@(ChromeOS), abdulsyed@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Labels: -M-66 -Merge-Review-66 M-65
Given that these IDs have been rolled out via Finch no merge to M-66 is necessary.
Is this need a merge to M65?
The Finch trial covers M-65 as well. No need for a merge.
Project Member

Comment 17 by sheriffbot@chromium.org, Jun 12 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment