Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
Do not crash when a report has no fields.
Fake USB gadgets can send their own HID report descriptors and can define report structures without valid fields. This can be used to crash the kernel over USB.
Details
- Affected product:
- AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
- Affected packages:
- linux @ 5.4.0 (+5 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 9.2 ESU | Released |
23 kernels
|
| AlmaLinux 9.6 ESU | Released |
9 kernels
|
| Debian 11 | Released |
37 kernels
|
| Debian 11 cloud | Released |
17 kernels
|
| Debian 13 | Planned | — |
| Ubuntu 22.04 | Planned | — |
| Ubuntu 24.04 | Planned | — |
| Ubuntu 24.04 AWS | Planned | — |