Security News > 2022 > January > Home routers with NetUSB support could have critical kernel hole
The idea is a neat one: NetUSB is a virtual connector for USB hardware, so that you can plug a range of different USB devices directly into your router, and then access them remotely from some, many or all of the other devices on your network.
Sentinel One researcher Max van Amerongen figured there might be code worth digging into when he examined a NetGear router during 2021 and found a kernel driver listening for network connections on TCP port 20005.
The networking interface used for localhost is accessible only to programs running directly on the router itself - indeed, the "Network card" for this interface is implemented entirely in software, and typically gets the IP number 127.0.0.1 on IPv4 networks.
The IPv4 network can support approximately 4 billion different simultaneously connected and uniquely identifiable devices.
U32 size = read(socket,4); // get 32-bit size from network void* buff = kernel alloc(size+17); // allocate the needed memory, plus 17 additional bytes if // make sure there was enough memory.
What to do? If you have a router that offers NetUSB for mounting devices over the network, check for an update.