Description
In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
dde5845a529ff753364a6d1aea61180946270bfa to < 6cdf6c708717c5c6897d0800a1793e83757c7491affecteddde5845a529ff753364a6d1aea61180946270bfa to < eeeaba737919bdce9885e2a00ac2912f61a3684daffecteddde5845a529ff753364a6d1aea61180946270bfa to < 3c86548a20d7bc2861aa4de044991a327bebad1aaffecteddde5845a529ff753364a6d1aea61180946270bfa to < 810189546cb6c8f36443ed091d91f1f5d2fc2ec7affecteddde5845a529ff753364a6d1aea61180946270bfa to < d3b504146c111548ab60b6ef7aad00bfb1db05a2affecteddde5845a529ff753364a6d1aea61180946270bfa to < 8b4a94b1510f6a46ec48494b52ee8f67eb4fc836affecteddde5845a529ff753364a6d1aea61180946270bfa to < 865ad8469fa24de1559f247d9426ab01e5ce3a56affecteddde5845a529ff753364a6d1aea61180946270bfa to < a6b87bfc2ab5bccb7ad953693c85d9062aef3fddaffected
Linux Linux
Default version status: affected
2.6.20affected0 to < 2.6.20unaffected5.10.248 to ≤ 5.10.*unaffected5.15.198 to ≤ 5.15.*unaffected6.1.159 to ≤ 6.1.*unaffected6.6.119 to ≤ 6.6.*unaffected6.12.46 to ≤ 6.12.*unaffected6.15.10 to ≤ 6.15.*unaffected6.16.1 to ≤ 6.16.*unaffected6.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6cdf6c708717c5c6897d0800a1793e83757c7491 ↗
- https://git.kernel.org/stable/c/eeeaba737919bdce9885e2a00ac2912f61a3684d ↗
- https://git.kernel.org/stable/c/3c86548a20d7bc2861aa4de044991a327bebad1a ↗
- https://git.kernel.org/stable/c/810189546cb6c8f36443ed091d91f1f5d2fc2ec7 ↗
- https://git.kernel.org/stable/c/d3b504146c111548ab60b6ef7aad00bfb1db05a2 ↗
- https://git.kernel.org/stable/c/8b4a94b1510f6a46ec48494b52ee8f67eb4fc836 ↗
- https://git.kernel.org/stable/c/865ad8469fa24de1559f247d9426ab01e5ce3a56 ↗
- https://git.kernel.org/stable/c/a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd ↗