Home / exploits

PDF

Linux HID picolcd NULL pointer dereference

Posted on 03 September 2013

<pre>I've found several issues in the Linux HID code. They are making their way into the Linux kernel via the linux-input tree now:

http://marc.info/?l=linux-input&amp;m=137772180514608&amp;w=10001-HID-validate-HID-report-id-size.patch
http://marc.info/?l=linux-input&amp;m=137772191714649&amp;w=10013-HID-picolcd_core-validate-output-report-details.patch

CVE-2013-2899
Requires CONFIG_HID_PICOLCD
Userspace-assisted NULL deref Oops DoS

A HID device could send a malicious output report that would cause the
picolcd HID driver to trigger a NULL dereference during attr file writing.

CVE-2013-2899

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Cc: stable@kernel.org
---
 drivers/hid/hid-picolcd_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index b48092d..72bba1e 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -290,7 +290,7 @@ static ssize_t picolcd_operation_mode_store(struct device *dev,
 		buf += 10;
 		cnt -= 10;
 	}
-	if (!report)
+	if (!report || report-&gt;maxfield &lt; 1)
 		return -EINVAL;
 
 	while (cnt &gt; 0 &amp;&amp; (buf[cnt-1] == '
' || buf[cnt-1] == '
'))
</pre>

 

TOP