Description
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() The 'wacom_wac_pen_serial_enforce()' function may calculate and pass an invalid offset to hid_field_extract(), resulting in memory reads at incorrect addresses -- possibly beyond the end of the report. If a field in the HID descriptor lists more usages than its Report Count actually reserves space for, the function's inner 'j' will walk past the end of the field: for (i = 0; i < report->maxfield; i++) { for (j = 0; j < report->field[i]->maxusage; j++) { ... value = hid_field_extract(hdev, raw_data + 1, offset + j * size, size); A descriptor listing 12288 usages against Report Count 1 has the loop extract the usage at index 12287 from bit offset 98296 -- about 12 KB past a 2-byte received report. The value is stored in wacom_wac->serial[0] and can reach userspace as an MSC_SERIAL event, making this an information disclosure. Clamp the loop to field->report_count, the number of value slots the report holds. Value slots past the last declared usage are still scanned; they reuse that usage (HID 1.11, 6.2.2.8). Verified on v6.12.105 with a UHID reproducer: a 2-byte report from such a descriptor trips KASAN before the patch and not after it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
83417206427bdf0fef9fa69957807194f25923c3 to < 9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51affected83417206427bdf0fef9fa69957807194f25923c3 to < 26471d954bbfbfb9032994f7f485802ee20e0582affected83417206427bdf0fef9fa69957807194f25923c3 to < 456afe4707e23cc114ad833197f63b52bb8fd1e7affected83417206427bdf0fef9fa69957807194f25923c3 to < 65e7c4b5366b770c60dfefac3f1d06e33a9e411eaffected83417206427bdf0fef9fa69957807194f25923c3 to < eaa7d29341ef4b91e84ad097562982288a7c376caffected83417206427bdf0fef9fa69957807194f25923c3 to < c3129e6f26e18c0886ede7265f187a7ec289e1d1affected83417206427bdf0fef9fa69957807194f25923c3 to < 4b09b7c84b8633cd041181616bd15bf5e73c164daffected83417206427bdf0fef9fa69957807194f25923c3 to < 9aa237cf66495b2426ddde8532e9b08a0ed83aaaaffected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9aa62f967b6a4bb30aa3b778e02c8a5ca6bcde51 ↗
- https://git.kernel.org/stable/c/26471d954bbfbfb9032994f7f485802ee20e0582 ↗
- https://git.kernel.org/stable/c/456afe4707e23cc114ad833197f63b52bb8fd1e7 ↗
- https://git.kernel.org/stable/c/65e7c4b5366b770c60dfefac3f1d06e33a9e411e ↗
- https://git.kernel.org/stable/c/eaa7d29341ef4b91e84ad097562982288a7c376c ↗
- https://git.kernel.org/stable/c/c3129e6f26e18c0886ede7265f187a7ec289e1d1 ↗
- https://git.kernel.org/stable/c/4b09b7c84b8633cd041181616bd15bf5e73c164d ↗
- https://git.kernel.org/stable/c/9aa237cf66495b2426ddde8532e9b08a0ed83aaa ↗