In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: bpf: Fix hid_bpf_get_data() range check<\/p>\n
hid_bpf_get_data() returns a pointer into the HID-BPF context data when
\nthe caller-provided offset and size fit inside ctx->allocated_size.<\/p>\n
The current check adds rdwr_buf_size and offset before comparing the
\nresult against ctx->allocated_size. Since both values are unsigned, a
\nvery large size can wrap the sum below ctx->allocated_size and make the
\nhelper return a pointer even though the requested range is not contained
\nin the backing buffer.<\/p>\n
Use check_add_overflow() to reject wrapped range ends before comparing
\nthe requested range end against ctx->allocated_size.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: bpf: Fix hid_bpf_get_data() range check<\/p>\n
hid_bpf_get_data() returns a pointer into the HID-BPF context data when
\nthe caller-pr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6985","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6985","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}