Description
In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the packet index on every complete packet tw_interrupt() accumulates each non-zero serial byte into a fixed three-byte buffer with a running index that is only reset once a full packet has been received *and* the device's two Y bytes agree: tw->data[tw->idx++] = data; if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) { ... tw->idx = 0; } The reset is gated on tw->data[1] == tw->data[2], a value the device controls. A malicious, malfunctioning or counterfeit Touchwindow peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the index reaches TW_LENGTH without the equality holding, is never reset, and keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte array and the rest of the heap-allocated struct tw, one attacker-chosen byte at a time -- an unbounded, device-driven heap out-of-bounds write. Reset the index on every completed packet and report an event only when the two Y bytes match, like the other serio touchscreen drivers do.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
11ea3173d5f2de71d037ef58ac43395795fed2bc to < ed9b66905407eb3d02df1aaeed82eb7a7f0eb508affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 044167cba2384bcd783547ad5e30ecd292b30919affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 6c9f29f128dd4057404838259af4c645318487e1affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 431ad239f2924dff337c3fccb9246597c1b63185affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 70e4248793762df9832fd4fc2fc6ac7924572c36affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 3e6f007b43e2fc6546e21fa74ee62c38984a6672affected11ea3173d5f2de71d037ef58ac43395795fed2bc to < a8d87184576c889759e3aab899799a482f1e1a5baffected11ea3173d5f2de71d037ef58ac43395795fed2bc to < 478cdd736f2ce3114f90e775d7358136d3977b94affected
Linux Linux
Default version status: affected
2.6.19affected0 to < 2.6.19unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508 ↗
- https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919 ↗
- https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1 ↗
- https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185 ↗
- https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36 ↗
- https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672 ↗
- https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b ↗
- https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94 ↗