In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: pidff: fix OOB write when hid->inputs is empty<\/p>\n
hid_pidff_init_with_quirks() derives its input_dev from<\/p>\n
\tlist_entry(hid->inputs.next, struct hid_input, list)<\/p>\n
without first checking that hid->inputs is non-empty. The list member
\nof struct hid_input is at offset 0, so on an empty list list_entry()
\nyields &hid->inputs itself and the following hidinput->input load reads
\nan unrelated member of struct hid_device. dev is then a type-confused
\npointer, and force-feedback init writes through it: each
\nset_bit(FF_*, dev->ffbit) stores 8 bytes at dev + 192, past the end of
\nthe object dev actually aliases, and input_ff_create() adds further
\nwrites of a heap pointer and two function pointers.<\/p>\n
Until hid-universal-pidff the only caller was hid_pidff_init() from
\nusbhid, which runs under HID_CLAIMED_INPUT and therefore always has at
\nleast one hid_input. universal_pidff_probe() starts the device with
\nHID_CONNECT_DEFAULT & ~HID_CONNECT_FF and then calls
\nhid_pidff_init_with_quirks() directly whenever the descriptor carries a
\nPID usage page, bypassing that gate. A report descriptor whose only
\napplication collection is on HID_UP_PID leaves hid->inputs empty while
\nhid_connect() still succeeds through the hidraw claim, so probe reaches
\nthe unguarded list_entry().<\/p>\n
The write happens in the USB probe path, on the hotplug workqueue, so
\nplugging in a malicious device is enough to trigger it; no attacker
\nsoftware and no logged-in user are required. KASAN reports an 8-byte
\nout-of-bounds write in hid_pidff_init_with_quirks() reached from
\nuniversal_pidff_probe().<\/p>\n
Check for an empty list before deriving dev and return -ENODEV, as the
\nother HID force-feedback drivers already do. universal_pidff_probe()
\npropagates the error and unwinds.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: pidff: fix OOB write when hid->inputs is empty<\/p>\n
hid_pidff_init_with_quirks() derives its input_dev from<\/p>\n
\tlist_entry(hid->inpu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17284","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}