In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: HIDP: validate numbered report payloads<\/p>\n
When hidp_get_raw_report() waits for a numbered report,
\nhidp_process_data() compares the expected report number with skb->data[0].
\nA connected HIDP peer can reply with only a DATA transaction header,
\nleaving the skb empty after the header is removed.<\/p>\n
KMSAN reports an uninitialized-value use in hidp_session_run(), with the
\nvalue originating in __alloc_skb() through vhci_write(). The transaction
\nheader checks remove the empty-frame reports, but this report remains until
\nthe payload check is added.<\/p>\n
The comparison can also consume a peer-controlled byte beyond the declared
\nL2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made
\nthe current code accept that byte as report ID 1 and complete
\nHIDIOCGFEATURE with a zero-byte result. With this change the malformed
\nresponse is rejected with -EIO, while a subsequent valid response still
\nsucceeds.<\/p>\n
Require a payload byte before comparing a numbered report ID. Unnumbered
\nreports continue to accept an empty payload.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: HIDP: validate numbered report payloads<\/p>\n
When hidp_get_raw_report() waits for a numbered report,
\nhidp_process_data() com<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7500","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7500"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7500"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}