In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer<\/p>\n
quickspi_hid_raw_request() receives the caller’s buffer length in len, but
\nquickspi_get_report() never sees it and copies the whole device-supplied
\nresponse into buf regardless:<\/p>\n
memcpy(buf, qsdev->report_buf, qsdev->report_len);<\/p>\n
qsdev->report_len comes from the input report the touch controller returns,
\nwhile buf is sized to whatever the caller asked hidraw for through
\nHIDIOCGFEATURE or HIDIOCGINPUT. A response larger than that overflows buf
\nwith device-controlled content.<\/p>\n
The intel-quicki2c sibling already passes the caller length down to
\nquicki2c_get_report() and validates the response against it before the
\ncopy. Do the same here.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer<\/p>\n
quickspi_hid_raw_request() receives the caller’<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21541","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21541","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21541"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21541"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21541"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}