In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq<\/p>\n
wacom_intuos_pro2_bt_irq() receives the wire report length in `len`
\nbut never consults it before parsing. After the report-id gate it
\nunconditionally calls wacom_intuos_pro2_bt_pen() and then, selected by
\nfeatures.type, a fixed chain of sub-parsers, none of which receive
\n`len`:<\/p>\n
\twacom_intuos_pro2_bt_pen(wacom);
\n\tif (type == INTUOSP2_BT || type == INTUOSP2S_BT) {
\n\t\twacom_intuos_pro2_bt_touch(wacom);
\n\t\twacom_intuos_pro2_bt_pad(wacom);
\n\t\twacom_intuos_pro2_bt_battery(wacom);
\n\t} else {
\n\t\twacom_intuos_gen3_bt_pad(wacom);
\n\t\twacom_intuos_gen3_bt_battery(wacom);
\n\t}<\/p>\n
Each sub-parser dereferences wacom->data at fixed offsets. The furthest
\nbyte touched on each branch is:<\/p>\n
INTUOSP2_BT \/ INTUOSP2S_BT: wacom_intuos_pro2_bt_pad() reads data[285]
\n\t(the touchring byte), so the report must be at least 286 bytes;
\n INTUOSHT3_BT (“gen3”): wacom_intuos_gen3_bt_battery() reads data[45],
\n\tso the report must be at least 46 bytes.<\/p>\n
features.type is selected from the VID\/PID id_table entry and
\nwacom_setup_device_quirks() force-registers the pen\/pad\/touch inputs
\nfor that type independent of the report descriptor, so a malicious or
\nmalfunctioning paired\/spoofed Bluetooth peripheral can advertise that
\nVID\/PID and send an undersized report that still satisfies the
\ndata[0] == 0x80\/0x81 gate. The driver then reads past the received
\nreport and forwards the bytes to userspace via evdev (MSC_SERIAL \/
\nABS_MISC \/ ABS_WHEEL on the pen and pad input nodes), an out-of-bounds
\nread with a concrete userspace read-back channel, and a true
\nout-of-bounds read on transports whose backing buffer is sized to the
\n(small) report descriptor rather than a fixed-size staging buffer.<\/p>\n
This is the same class of bug commit 2f1763f62909 (“HID: wacom: fix
\nout-of-bounds read in wacom_intuos_bt_irq”) already hardened in the
\nsibling wacom_intuos_bt_irq(), which guards each report id against its
\nminimum length before parsing.<\/p>\n
Guard wacom_intuos_pro2_bt_irq() the same way: before parsing, reject
\nreports shorter than the furthest offset the selected branch actually
\ndereferences, warn, and bail out. Because the whole pen\/touch\/pad\/
\nbattery chain runs unconditionally per branch, a single up-front check
\nagainst the maximum offset (286 bytes for INTUOSP2_BT\/INTUOSP2S_BT,
\n46 bytes for the gen3 branch) bounds every sub-parser. Returning 0 on
\na short report also skips those calls for the same malformed report,
\nwhich is the safe, conservative behavior.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq<\/p>\n
wacom_intuos_pro2_bt_irq() receives the wire report length in `len`<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24686","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24686","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24686"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24686"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24686"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}