Home / exploits

PDF

Linux HID ntrig NULL pointer dereference

Posted on 03 September 2013

<pre>I've found several issues in the Linux HID code. They are making their way into the Linux kernel via the linux-input tree now:

http://marc.info/?l=linux-input&amp;m=137772180514608&amp;w=10001-HID-validate-HID-report-id-size.patch
http://marc.info/?l=linux-input&amp;m=137772189314633&amp;w=10010-HID-ntrig-validate-feature-report-details.patch

CVE-2013-2896
Requires CONFIG_HID_NTRIG
Triggers NULL deref Oops DoS

A HID device could send a malicious feature report that would cause the
ntrig HID driver to trigger a NULL dereference during initialization:

[57383.031190] usb 3-1: New USB device found, idVendor=1b96, idProduct=0001
...
[57383.315193] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
[57383.315308] IP: [&lt;ffffffffa08102de&gt;] ntrig_probe+0x25e/0x420 [hid_ntrig]

CVE-2013-2896

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Cc: stable@kernel.org
---
 drivers/hid/hid-ntrig.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index ef95102..5482156 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
 	struct hid_report *report = hdev-&gt;report_enum[HID_FEATURE_REPORT].
 				    report_id_hash[0x0d];
 
-	if (!report)
+	if (!report || report-&gt;maxfield &lt; 1 ||
+	    report-&gt;field[0]-&gt;report_count &lt; 1)
 		return -EINVAL;
 
 	hid_hw_request(hdev, report, HID_REQ_GET_REPORT);
</pre>

 

TOP