Description
In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not). The latter has size determined at runtime by the maximum size of different report types you could receive on any particular device and can be a much smaller value. Fix this by truncating `recv_len` to `ihid->bufsize - sizeof(__le16)`. The impact is low since access to hidraw devices requires root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
85df713377ddc0482071c3e6b64c37bd1e48f1f1 to < f9c9ad89d845f88a1509e9d672f65d234425fde9affected85df713377ddc0482071c3e6b64c37bd1e48f1f1 to < cff3f619fd1cb40cdd89971df9001f075613d219affected85df713377ddc0482071c3e6b64c37bd1e48f1f1 to < 786ec171788bdf9dda38789163f1b1fbb47f2d1eaffected85df713377ddc0482071c3e6b64c37bd1e48f1f1 to < 2124279f1f8c32c1646ce98e75a1a39b23b7db76affected85df713377ddc0482071c3e6b64c37bd1e48f1f1 to < 2497ff38c530b1af0df5130ca9f5ab22c5e92f29affected
Linux Linux
Default version status: affected
5.18affected0 to < 5.18unaffected6.1.163 to ≤ 6.1.*unaffected6.6.124 to ≤ 6.6.*unaffected6.12.70 to ≤ 6.12.*unaffected6.18.10 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f9c9ad89d845f88a1509e9d672f65d234425fde9 ↗
- https://git.kernel.org/stable/c/cff3f619fd1cb40cdd89971df9001f075613d219 ↗
- https://git.kernel.org/stable/c/786ec171788bdf9dda38789163f1b1fbb47f2d1e ↗
- https://git.kernel.org/stable/c/2124279f1f8c32c1646ce98e75a1a39b23b7db76 ↗
- https://git.kernel.org/stable/c/2497ff38c530b1af0df5130ca9f5ab22c5e92f29 ↗