CVE-2021-46906

HID: usbhid: fix info leak in hid_submit_ctrl

published February 26, 2024

CVSS
—
EPSS
0%
Percentile
14.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't

take into account that report->size can be zero. When running the

syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to

calculate transfer_buffer_length as 16384. When this urb is passed to

the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero

report size case by using DIV_ROUND_UP for the division. Then, call it

from hid_submit_ctrl().

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.8th percentile
Published
2024-02-26T17:20Z
EPSS history
Timeline
  • 26 FEB 17:20Z
    HID: usbhid: fix info leak in hid_submit_ctrl
    cvelistv5