In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Input: evdev – zero absinfo before partial copy in EVIOCSABS<\/p>\n
The EVIOCSABS handler copies at most the user supplied ioctl size into
\nan uninitialized on-stack struct input_absinfo:<\/p>\n
\tif (copy_from_user(&abs, p, min_t(size_t,
\n\t\t\tsize, sizeof(struct input_absinfo))))<\/p>\n
The size comes from _IOC_SIZE() of the ioctl command and is therefore
\nfully controlled by userspace. A short size leaves the trailing part of
\nthe structure holding whatever was on the kernel stack, and the whole
\nstructure is then stored into the device:<\/p>\n
\tdev->absinfo[t] = abs;<\/p>\n
EVIOCGABS hands that back to userspace, disclosing the stale stack
\nbytes. Only the resolution field is currently cleared, which covers the
\nlegacy struct layout but not an arbitrarily short size.<\/p>\n
Zero the structure before the copy so any part not supplied by the
\ncaller reads back as zero. The existing resolution fixup is kept, since
\nit also handles a size that partially overlaps that field.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Input: evdev – zero absinfo before partial copy in EVIOCSABS<\/p>\n
The EVIOCSABS handler copies at most the user supplied ioctl size int<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33274","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}