Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport] Windows: Restrict path for dynamic library loading #2

Open
wants to merge 1 commit into
base: hp
Choose a base branch
from

Conversation

jibeee
Copy link

@jibeee jibeee commented Sep 21, 2021

This PR prevents DLL planting on Windows.

libusb loads USB backends from various path using LoadLibrary. This
function performs a search through various path when provided a library
name that does not include a path element. An attacker could plant a DLL
in one of the searched path, and it would be loaded by libusb.

To prevent this, libraries are now only loaded from the Windows system
directory.

Based on libusb@c3deb6d

@kevinmehall
Copy link
Collaborator

This outdated fork of libusb has many problems, and backporting changes one-by-one seems futile.

cc @thegecko -- I can move this fork to the node-usb org if you want it.

@thegecko
Copy link
Member

I can move this fork to the node-usb org if you want it.

I think that makes sense. Happy to then update the submodule

@kevinmehall
Copy link
Collaborator

Transferred the repo

@jibeee
Copy link
Author

jibeee commented Sep 28, 2021

Do you need more information for the review?

@thegecko
Copy link
Member

Do you need more information for the review?

@kevinmehall is better placed to review this PR. We need to decide whether to either apply patches like this or re-implement hotplug support on top of the latest libusb.

Alternatively, if everyone could focus on fixing libusb#86, we could just use upstream libusb :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants