Home / exploits

PDF

Linux HID sensor-hub heap overflow

Posted on 03 September 2013

<pre>I've found several issues in the Linux HID code. They are making their way into the Linux kernel via the linux-input tree now:

http://marc.info/?l=linux-input&amp;m=137772180514608&amp;w=10001-HID-validate-HID-report-id-size.patch
http://marc.info/?l=linux-input&amp;m=137772191114645&amp;w=10012-HID-sensor-hub-validate-feature-report-details.patch

CVE-2013-2898
Requires CONFIG_HID_SENSOR_HUB
Potential kernel caller confusion via past-end-of-heap-allocation read

A HID device could send a malicious feature report that would cause the
sensor-hub HID driver to read past the end of heap allocation, leaking
kernel memory contents to the caller.

CVE-2013-2898

Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Cc: stable@kernel.org
---
 drivers/hid/hid-sensor-hub.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
index ca749810..aa34755 100644
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -221,7 +221,8 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id,
 
 	mutex_lock(&amp;data-&gt;mutex);
 	report = sensor_hub_report(report_id, hsdev-&gt;hdev, HID_FEATURE_REPORT);
-	if (!report || (field_index &gt;=  report-&gt;maxfield)) {
+	if (!report || (field_index &gt;=  report-&gt;maxfield) ||
+	    report-&gt;field[field_index]-&gt;report_count &lt; 1) {
 		ret = -EINVAL;
 		goto done_proc;
 	}</pre>

 

TOP