In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()<\/p>\n
The ‘wacom_wac_pen_serial_enforce()’ function may calculate and pass an
\ninvalid offset to hid_field_extract(), resulting in memory reads at
\nincorrect addresses — possibly beyond the end of the report. If a
\nfield in the HID descriptor lists more usages than its Report Count
\nactually reserves space for, the function’s inner ‘j’ will walk past
\nthe end of the field:<\/p>\n
\tfor (i = 0; i maxfield; i++) {
\n\t\tfor (j = 0; j field[i]->maxusage; j++) {
\n\t\t\t…
\n\t\t\tvalue = hid_field_extract(hdev, raw_data + 1,
\n\t\t\t\t\t\t offset + j * size, size);<\/p>\n
A descriptor listing 12288 usages against Report Count 1 has the loop
\nextract the usage at index 12287 from bit offset 98296 — about 12 KB
\npast a 2-byte received report. The value is stored in
\nwacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event,
\nmaking this an information disclosure.<\/p>\n
Clamp the loop to field->report_count, the number of value slots the
\nreport holds. Value slots past the last declared usage are still
\nscanned; they reuse that usage (HID 1.11, 6.2.2.8).<\/p>\n
Verified on v6.12.105 with a UHID reproducer: a 2-byte report from
\nsuch a descriptor trips KASAN before the patch and not after it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()<\/p>\n
The ‘wacom_wac_pen_serial_enforce()’ function may calculate and pass an<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40971","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}