HID: bpf: prevent buffer overflow in hid_hw_request
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.78, 6.18.20, 6.19.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when playing with HID-BPF, the return value can be arbitrary big, because it's the return value of dispatch_hid_bpf_raw_requests(), which calls the struct_ops and we have no guarantees that the value makes sense.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 · fixed in d6efaa50af62fb0790dd1fd4e7e5506b46312510; From 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 · fixed in 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1; From 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 · fixed in eb57dae20fdf6f3069cdc07821fa3bb46de381d7; From 8bd0488b5ea58655ad6fdcbe0408ef49b16882b1 · fixed in 2b658c1c442ec1cd9eec5ead98d68662c40fe645
- Linux Linux
6.11
- KernelLinux
From 6.11.0 · fixed in 6.12.78; From 6.13.0 · fixed in 6.18.20; From 6.19.0 · fixed in 6.19.10