Description
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: validate initial device info bounds The Hyper-V synthetic HID host supplies SYNTH_HID_INITIAL_DEVICE_INFO messages that contain a HID descriptor followed by the report descriptor bytes. mousevsc_on_receive_device_info() trusts bLength and wDescriptorLength without checking that the received packet contains both byte ranges. A malformed host or backend message can therefore make the guest read past the received VMBus packet while copying the report descriptor. Pass the received initial-device-info size into the parser and reject descriptor lengths that exceed the packet. Impact: A malicious Hyper-V host or backend can crash a guest by sending a short initial device-info message with an oversized HID report descriptor length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b95f5bcb811e3905b5376f87789da8d097fee682 to < e0d5d3e45e142b7ef7525654aaa54d3e986002a6affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 390d3d9c52a710fdc9de95a537747397c0c671d1affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 8614c043b11cc35ffebd35542ab4da275f8f923daffectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 334271d3812ab3197c95b4593bc6745f8d189114affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < f84d777574b748b1a488723ca7be9d87a301a872affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 608f8fd8c0f7b6268da43509447802955f210aacaffectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 2529737763cb4bcfcaf397beeea2664656c865b4affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < c894143c508a7e063aab9f73c9e835ab40121283affectedb95f5bcb811e3905b5376f87789da8d097fee682 to < 934b7778aa7b7c8f6bb073d2a73ba3674885bae0affected
Linux Linux
Default version status: affected
3.3affected0 to < 3.3unaffected5.10.267 to ≤ 5.10.*unaffected5.15.218 to ≤ 5.15.*unaffected6.1.185 to ≤ 6.1.*unaffected6.6.154 to ≤ 6.6.*unaffected6.12.106 to ≤ 6.12.*unaffected6.18.47 to ≤ 6.18.*unaffected7.1.11 to ≤ 7.1.*unaffected7.2.1 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e0d5d3e45e142b7ef7525654aaa54d3e986002a6 ↗
- https://git.kernel.org/stable/c/390d3d9c52a710fdc9de95a537747397c0c671d1 ↗
- https://git.kernel.org/stable/c/8614c043b11cc35ffebd35542ab4da275f8f923d ↗
- https://git.kernel.org/stable/c/334271d3812ab3197c95b4593bc6745f8d189114 ↗
- https://git.kernel.org/stable/c/f84d777574b748b1a488723ca7be9d87a301a872 ↗
- https://git.kernel.org/stable/c/608f8fd8c0f7b6268da43509447802955f210aac ↗
- https://git.kernel.org/stable/c/2529737763cb4bcfcaf397beeea2664656c865b4 ↗
- https://git.kernel.org/stable/c/c894143c508a7e063aab9f73c9e835ab40121283 ↗
- https://git.kernel.org/stable/c/934b7778aa7b7c8f6bb073d2a73ba3674885bae0 ↗