HID: hidpp: fix potential UAF in hidpp_connect_event()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.189, 6.6.158, 6.12.111, 6.18.53
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidpp_connect_event() If input_register_device() fails, we call input_free_device(), but keep stale pointer to the old device in hidpp->input, which could potentially lead to UAF. Fix that by resetting it to NULL before returning from hidpp_connect_event().
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From c39e3d5fc9dd3e16c6f59dd94d827540040de66d · fixed in e03fd646adad7f97fa4429ec5f38cee9bde5276e; From c39e3d5fc9dd3e16c6f59dd94d827540040de66d · fixed in 5d7637f4d050d105177217e64b869f56f9825060; From c39e3d5fc9dd3e16c6f59dd94d827540040de66d · fixed in 3b8b2e58b078cd30e121401535541bb8a6d57133; From c39e3d5fc9dd3e16c6f59dd94d827540040de66d · fixed in 3303398cc2aa255ba251650a30024e11d48ea6c3; From c39e3d5fc9dd3e16c6f59dd94d827540040de66d · fixed in 6df6b1f2c49678211f65647c300bc51dda02893b
- Linux Linux
3.19
- KernelLinux
From 3.19.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53