In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: core: Fix OOB read in hid_get_report for numbered reports<\/p>\n
When a caller passes a size of 0 to hid_report_raw_event() for a
\nnumbered report, the function originally called hid_get_report() before
\nperforming any size validation.<\/p>\n
Inside hid_get_report(), if the report is numbered (report_enum->numbered
\nis true), it unconditionally dereferences data[0] to extract the report ID.
\nWith a size of 0, this results in an out-of-bounds read or kernel panic.<\/p>\n
Fix this by moving the numbered report size validation check before the
\ncall to hid_get_report(), ensuring that size is at least 1 before
\ndereferencing the data pointer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: core: Fix OOB read in hid_get_report for numbered reports<\/p>\n
When a caller passes a size of 0 to hid_report_raw_event() for a
\nnu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12299","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}