Description
In the Linux kernel, the following vulnerability has been resolved: Input: zero ff_effect before compat copy in input_ff_effect_from_user In the compat path input_ff_effect_from_user() aliases the caller's native struct ff_effect with the smaller struct ff_effect_compat and copies only the compat sized prefix: compat_effect = (struct ff_effect_compat *)effect; if (copy_from_user(compat_effect, buffer, sizeof(struct ff_effect_compat))) The tail of the native structure is never written. Callers pass an uninitialized on-stack object, for example evdev_do_ioctl() for EVIOCSFF, so those bytes keep their previous stack contents. input_ff_upload() then stores the full native structure in ff->effects[id], from where a uinput based force feedback daemon can read it back via UI_BEGIN_FF_UPLOAD, disclosing kernel stack memory to userspace. Zero the effect before the compat copy.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2d56f3a32c0e62f99c043d2579840f9731fe5855 to < ed0905fda39682d3da7937184397d3276abbffa8affected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < ec174c2ab1abb76b20fa167c6db848c3d97aa838affected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < 6c26681c5668c973bd0e951407d670ac60d9cd66affected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < c5e573bb095d502be7cbbaa99c26a20984111c6daffected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < b878720e8bcaa4cf7163a5081f904dd6baf11b2caffected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < 0d05b43b55d4784a42ce8fb318175f8ad7d9af5aaffected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < ed0406e490f48ed180df140fe2a81be26bccb1a9affected2d56f3a32c0e62f99c043d2579840f9731fe5855 to < f84819ef8d66931ee3998fee3c4f03230f4cb6ccaffected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ed0905fda39682d3da7937184397d3276abbffa8 ↗
- https://git.kernel.org/stable/c/ec174c2ab1abb76b20fa167c6db848c3d97aa838 ↗
- https://git.kernel.org/stable/c/6c26681c5668c973bd0e951407d670ac60d9cd66 ↗
- https://git.kernel.org/stable/c/c5e573bb095d502be7cbbaa99c26a20984111c6d ↗
- https://git.kernel.org/stable/c/b878720e8bcaa4cf7163a5081f904dd6baf11b2c ↗
- https://git.kernel.org/stable/c/0d05b43b55d4784a42ce8fb318175f8ad7d9af5a ↗
- https://git.kernel.org/stable/c/ed0406e490f48ed180df140fe2a81be26bccb1a9 ↗
- https://git.kernel.org/stable/c/f84819ef8d66931ee3998fee3c4f03230f4cb6cc ↗