CME-1013
USBGuard — USB Device Access Control
Description
Kernel-level USB device authorization framework that enforces allow/deny/block policies for USB peripheral attachment. Prevents BadUSB attacks (malicious USB devices that emulate keyboards/network adapters), DMA-based attacks via Thunderbolt/USB-C, and unauthorized data exfiltration via USB storage. Integrates with udev and auditd for USB event logging and policy enforcement. Policies can be defined per device class, vendor ID, product ID, or serial number.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | P → L | Physical access required but mitigated; unauthorized USB devices blocked at kernel level |
| Attack Complexity (AC) | L → H | Requires authorized USB device matching policy; rogue devices auto-blocked |
CWE Relationships
Verification
Verify USBGuard daemon running and policy enforcement active
$ systemctl is-active usbguard
# Expected: active
# Expected: active
Platform: linux
$ usbguard list-devices | head -5
# Expected: Lists devices with allow/block/reject policy
# Expected: Lists devices with allow/block/reject policy
Platform: linux
$ usbguard get-parameter InsertedDevicePolicy
# Expected: block (or apply-policy)
# Expected: block (or apply-policy)
Platform: linux
$ usbguard get-parameter ImplicitPolicyTarget
# Expected: block (or reject)
# Expected: block (or reject)
Platform: linux
Remediation
linux
USBGuard default-block policy from currently connected devices
dnf install -y usbguard
usbguard generate-policy > /etc/usbguard/rules.conf
systemctl enable --now usbguard