HID: bigben: fix slab-out-of-bounds Write in bigben_probe
Summary
GSD-2022-1003754: HID: bigben: fix slab-out-of-bounds Write in bigben_probe. Affects Kernel versions < 00771de7cc28e405f5ae19ca46facd83a534bb8f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HID (Human Interface Device) bigben is a component of the Linux Kernel. It is responsible for handling input from certain types of HID devices. The bigben_probe function is a part of this component and is used to initialize the bigben device. However, a vulnerability has been discovered in this function that could lead to a slab-out-of-bounds write. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability in the bigben_probe function is caused by a slab-out-of-bounds write. This occurs when the function writes data beyond the bounds of an allocated memory slab. An attacker could potentially exploit this vulnerability by sending specially crafted input to the bigben device, triggering the out-of-bounds write and potentially gaining control over the affected system. The impact and attack plausibility of this vulnerability have not yet been proven. However, it is important to address this issue to prevent any potential security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The HID bigben component in the Linux Kernel is vulnerable to a slab-out-of-bounds write in the bigben_probe function. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.4.198 or later. There are no known workarounds for this issue. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service on the affected system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the playground will analyze it for any open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the Linux Kernel to the latest version to address this issue.
There is currently no evidence of this vulnerability being actively exploited. However, it is still important to apply the necessary updates to mitigate any potential risks.
You can find more information about this vulnerability in the GSD-2022-1003754 JSON file available in the GSD database (https://github.com/cloudsecurityalliance/gsd-database).
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
