linux-kernel - Re: [PATCH 0/5] HID: manually unregister leds on device removal to prevent UAFs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZFuC7VEMJzdBulg/@duo.ucw.cz>
Date:   Wed, 10 May 2023 13:41:33 +0200
From:   Pavel Machek <pavel@....cz>
To:     Donald Buczek <buczek@...gen.mpg.de>
Cc:     Pietro Borrello <borrello@...g.uniroma1.it>,
        Jiri Kosina <jikos@...nel.org>,
        Benjamin Tissoires <benjamin.tissoires@...hat.com>,
        Hanno Zulla <kontakt@...no.de>,
        Carlo Caione <carlo@...lessm.com>, Lee Jones <lee@...nel.org>,
        Roderick Colenbrander <roderick.colenbrander@...y.com>,
        Sven Eckelmann <sven@...fation.org>,
        linux-leds@...r.kernel.org,
        Cristiano Giuffrida <c.giuffrida@...nl>,
        "Bos, H.J." <h.j.bos@...nl>, Jakob Koschel <jkl820.git@...il.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org,
        Jiri Kosina <jkosina@...e.cz>,
        Roderick Colenbrander <roderick@...kai.com>
Subject: Re: [PATCH 0/5] HID: manually unregister leds on device removal to
 prevent UAFs

On Wed 2023-05-10 12:12:50, Donald Buczek wrote:
> Is this series in a queue somewhere? Seems rather important and I don't find progress.
> 
> Also, should be cc: stable@...r.kernel.org , right?
> 
> CVE-2023-25012

It has Fixes, stable will pick it up.

And yes, "crafted USB device" can do a bad stuff. Severity is not too
high.

BR,
									Pavel
-- 
People of Russia, stop Putin before his war on Ukraine escalates.

Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)