Description
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
67a95c21463d066060b0f66d65a75d45bb386ffb to < cb38b1f149b7143355b37e86c841acf0076e5c2aaffected67a95c21463d066060b0f66d65a75d45bb386ffb to < b2c67dc0e30c308647bbd9b9e5d69a44c9d2733daffected67a95c21463d066060b0f66d65a75d45bb386ffb to < fffcfa367072628c3144cca17d2a3c3c9e50c057affected67a95c21463d066060b0f66d65a75d45bb386ffb to < c1c508e8923911cb458234997e55b7a4b9aa066faffected67a95c21463d066060b0f66d65a75d45bb386ffb to < bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149affected67a95c21463d066060b0f66d65a75d45bb386ffb to < 127de5919820f88a9d55e8371ad4ac49f625f4c5affected67a95c21463d066060b0f66d65a75d45bb386ffb to < 7c18fb36708a97ff6772825cc087b6d537bbf0d5affected67a95c21463d066060b0f66d65a75d45bb386ffb to < 2c9a6998c19503626c57a2267bf279e204113079affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cb38b1f149b7143355b37e86c841acf0076e5c2a ↗
- https://git.kernel.org/stable/c/b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d ↗
- https://git.kernel.org/stable/c/fffcfa367072628c3144cca17d2a3c3c9e50c057 ↗
- https://git.kernel.org/stable/c/c1c508e8923911cb458234997e55b7a4b9aa066f ↗
- https://git.kernel.org/stable/c/bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149 ↗
- https://git.kernel.org/stable/c/127de5919820f88a9d55e8371ad4ac49f625f4c5 ↗
- https://git.kernel.org/stable/c/7c18fb36708a97ff6772825cc087b6d537bbf0d5 ↗
- https://git.kernel.org/stable/c/2c9a6998c19503626c57a2267bf279e204113079 ↗