Description
In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device would never lie about the number of touch reports would it? If it does the loop in dualshock4_parse_report will read off the end of the touch_reports array, up to about 2 KiB for the maximum number of 256 loop iteraions. The data that is read is emitted via evdev if the DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by clamping the num_touch_reports value provided by the device to the maximum size of the touch_reports array.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
752038248808a7ff176bbdb668f19ae7d2a9816b to < 0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4affected752038248808a7ff176bbdb668f19ae7d2a9816b to < 9c031b24aed6733b6dcc5d98527875b8654a04e9affected752038248808a7ff176bbdb668f19ae7d2a9816b to < 7812694752a5f295eaa05a093b90a2c332666051affected752038248808a7ff176bbdb668f19ae7d2a9816b to < 208f6d5b1dfd6399bc6af9e11f27f1f496243ed0affected752038248808a7ff176bbdb668f19ae7d2a9816b to < cac61b58a3b6340c52afa06bb15eac033158db2faffected
Linux Linux
Default version status: affected
6.2affected0 to < 6.2unaffected6.6.140 to ≤ 6.6.*unaffected6.12.90 to ≤ 6.12.*unaffected6.18.32 to ≤ 6.18.*unaffected7.0.9 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4 ↗
- https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9 ↗
- https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051 ↗
- https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0 ↗
- https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f ↗