In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: universal-pidff: stop the device when force-feedback init fails<\/p>\n
universal_pidff_probe() starts the device with hid_hw_start() and then, if
\nforce-feedback initialisation fails, returns the error through a label that
\nonly does “return error”. The device is left started.<\/p>\n
The HID core does not unwind on the driver’s behalf. __hid_device_probe()
\nreleases the devres group, closes the report and clears hdev->driver:<\/p>\n
\tif (ret) {
\n\t\tdevres_release_group(&hdev->dev, hdev->devres_group_id);
\n\t\thid_close_report(hdev);
\n\t\thdev->driver = NULL;
\n\t}<\/p>\n
The hidraw character device that hid_hw_start() registered through
\nhid_connect() is allocated with kzalloc() and added with cdev_device_add(),
\nso it is not devres-managed and survives that. With hdev->driver NULL,
\nhid_device_remove() skips hid_hw_stop() as well, because it only unwinds
\nwhile a driver is still attached. The registration therefore outlives the
\ndevice on both paths.<\/p>\n
Opening the surviving \/dev\/hidrawX writes into freed memory. KASAN reports
\na use-after-free write from hidraw_open() -> hid_hw_open() -> the
\ntransport’s open callback, which takes a spinlock inside the freed object.
\nA descriptor that carries a PID usage page and no input reports is enough:
\nhidraw claims the device so hid_hw_start() succeeds, while hid->inputs
\nstays empty so force-feedback init fails. The other failure returns in
\nhid_pidff_init_with_quirks() – no output reports, an allocation failure,
\npidff_init_fields(), pidff_check_autocenter(), an unusable effect count,
\ninput_ff_create() – all reach the same label.<\/p>\n
Stop the device on that path. hid-dr.c and hid-emsff.c, which start the
\ndevice with the same HID_CONNECT_DEFAULT & ~HID_CONNECT_FF mask, already do
\nthis. The two earlier gotos must keep returning without hid_hw_stop(),
\nsince neither has a started device, so give the path that fails after the
\nstart its own label.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: universal-pidff: stop the device when force-feedback init fails<\/p>\n
universal_pidff_probe() starts the device with hid_hw_start()<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21546","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21546","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21546"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21546"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21546"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}