Gone in 60 Frames - USB Video Exploitation

The talk starts from a 2025 Amnesty International and Google TAG report on an in-the-wild chain of Linux kernel USB bugs used against phones. That report described the vulnerabilities but not how to exploit them. The speakers, from NCC Group, set out to close that gap. They mapped the USB attack surface, noting that desktop distributions enable far more device classes than a typical Android kernel, and explained descriptor hierarchies and class specifications such as HID, UVC and mass storage. They also described their experience building tooling to insert and remove emulated USB devices programmatically.

The middle section covers two bugs. The first is an information disclosure in the HID raw request path, where a malformed buffer makes a length underflow to a very large value, leaking about 64 KB of kernel memory. The team matched recurring kernel text pointers against known offsets to recover the kernel base, bypassing KASLR. The second is an out-of-bounds write in the UVC driver, triggered by a specific quirk. The speakers turned a min/max check into a way to locate a writable 32-bit value near the frame interval pointer, then used it to overwrite the uevent_helper path so that a script on an attacker-supplied USB stick runs as root.

The talk closes with a live demonstration on an Ubuntu desktop. A single emulated USB device leaks the kernel base, performs the write and returns a root reverse shell. The takeaway is that USB is a practical attack vector, and that inexpensive hardware and a small amount of custom tooling are enough to build a working exploit. The speakers point listeners to the full written paper for the details they could not cover.