Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
HID: core: Fix OOB read in hid_get_report for numbered reports
When a caller passes a size of 0 to hid_report_raw_event() for a numbered report, the function originally called hid_get_report() before performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered is true), it unconditionally dereferences data[0] to extract the report ID. With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the call to hid_get_report(), ensuring that size is at least 1 before dereferencing the data pointer.
Details
- Affected product:
- Debian 10 ELS , Debian 11 ELS
- Affected packages:
- linux @ 5.10.259 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Amazon Linux 2023 | Planned | — |
| Oracle Linux 9 UEK 7 | Planned | — |