In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: magicmouse: do not keep a stale msc->input if no input is claimed<\/p>\n
magicmouse_input_mapping() caches the first hid_input’s input_dev in
\nmsc->input while the report descriptor is parsed, and the rest of the
\ndriver treats a non-NULL msc->input as proof that an input device was
\nregistered.<\/p>\n
That does not hold on the hid-input error path. If hidinput_connect()
\nfails — for instance because input_register_device() returns an error —
\nit unwinds through hidinput_disconnect(), which frees every input_dev it
\ncreated, including the one cached in msc->input.<\/p>\n
The failure does not abort the probe. hid_connect() only skips the claim:<\/p>\n
\tif ((connect_mask & HID_CONNECT_HIDINPUT) && !hidinput_connect(hdev,
\n\t\t\t\tconnect_mask & HID_CONNECT_HIDINPUT_FORCE))
\n\t\thdev->claimed |= HID_CLAIMED_INPUT;<\/p>\n
and the “device has no listeners” bailout below it does not fire for this
\ndriver, which sets ->raw_event; on the USB Magic Mouse 2 \/ Magic Trackpad
\n2 paths hidraw and hiddev are claimed as well. hid_hw_start() therefore
\nreturns 0 and magicmouse_probe() continues with msc->input pointing at
\nfreed memory. Being non-NULL, it passes the “input not registered” check
\nin probe and the NULL checks in ->raw_event and ->event, so the next
\ninput report dereferences freed memory.<\/p>\n
Clear msc->input when the HID core did not claim an input device, so the
\nexisting NULL checks cover this case as well.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: magicmouse: do not keep a stale msc->input if no input is claimed<\/p>\n
magicmouse_input_mapping() caches the first hid_input’s inp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17286","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17286"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17286"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}