In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: core: fix OOB read of field->usage in hid_set_field()<\/p>\n
hid_set_field() hands field->usage + offset to hid_dump_input() before
\nthe guard that bounds offset:<\/p>\n
\thid_dump_input(field->report->device, field->usage + offset, value);<\/p>\n
\tif (offset >= field->report_count) {
\n\t\thid_err(…);
\n\t\treturn -1;
\n\t}<\/p>\n
Under CONFIG_DEBUG_FS hid_dump_input() dereferences that pointer, with
\nbuf = hid_resolv_usage(usage->hid, NULL). The usage[] array is
\nallocated inline with the hid_field in hid_register_field() and holds
\nfield->maxusage entries, so an offset past it reads off the end of the
\nkvzalloc()ed allocation and into a neighbouring object. Had the guard
\nrun first, offset < report_count maxfield before issuing
\nhid_set_field(report->field[0], 11 + i, …) for i = 0..31, so its
\noffsets are fixed at 11..42 and are never checked against the bound
\nfield. When the device registers that field with fewer usages, the
\nframebuffer deferred-io work drives the read on every tile. KASAN
\nreports a 4-byte slab-out-of-bounds read in hid_dump_input() below
\nhid_set_field(), and the same boot logs “offset (1) exceeds
\nreport_count (1)” from the guard that runs only afterwards.<\/p>\n
Move the hid_dump_input() call below the guard. Because
\nfield->maxusage >= field->report_count, the guard then establishes that
\nfield->usage + offset lies inside the array before it is dereferenced,
\nfor every caller and without changing behaviour on the valid path.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: core: fix OOB read of field->usage in hid_set_field()<\/p>\n
hid_set_field() hands field->usage + offset to hid_dump_input() before<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17285","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}