linux-kernel - Re: [PATCH RESEND] HID: asus: fix UAF via HID_CLAIMED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <175507820932.20076.1828761859413180643.b4-ty@kernel.org>
Date: Wed, 13 Aug 2025 11:43:29 +0200
From: Benjamin Tissoires <bentiss@...nel.org>
To: jikos@...nel.org, linux-input@...r.kernel.org, 
 linux-kernel@...r.kernel.org, Qasim Ijaz <qasdev00@...il.com>
Cc: stable@...r.kernel.org
Subject: Re: [PATCH RESEND] HID: asus: fix UAF via HID_CLAIMED_INPUT
 validation

On Sun, 10 Aug 2025 19:10:41 +0100, Qasim Ijaz wrote:
> After hid_hw_start() is called hidinput_connect() will eventually be
> called to set up the device with the input layer since the
> HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()
> all input and output reports are processed and corresponding hid_inputs
> are allocated and configured via hidinput_configure_usages(). This
> process involves slot tagging report fields and configuring usages
> by setting relevant bits in the capability bitmaps. However it is possible
> that the capability bitmaps are not set at all leading to the subsequent
> hidinput_has_been_populated() check to fail leading to the freeing of the
> hid_input and the underlying input device.
> 
> [...]

Applied to hid/hid.git (for-6.17/upstream-fixes), thanks!

[1/1] HID: asus: fix UAF via HID_CLAIMED_INPUT validation
      https://git.kernel.org/hid/hid/c/d3af6ca9a8c3

Cheers,
-- 
Benjamin Tissoires <bentiss@...nel.org>