Double Free Vulnerability in HID: elan
Summary
GSD-2022-1003805: HID: elan: Fix potential double free in elan_input_configured. Affects Kernel versions >= 82d4cfa185a93456c5c279b79f80af4f1319854c, < f1d4f19a796551edc6679a681ea1756b8c578c08. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HID: elan package is a component of the Linux Kernel, which is responsible for handling input devices. It includes drivers for various touchpads, including those manufactured by Elan. These drivers enable the communication between the touchpad hardware and the operating system, allowing users to interact with their devices through touch gestures. However, a vulnerability has been discovered in the elan_input_configured function of the HID: elan package, which could lead to a double free issue.
Vulnerability Detail
The double free vulnerability in the elan_input_configured function of the HID: elan package allows an attacker to potentially exploit the system by causing a memory corruption. This vulnerability arises from a programming error that results in the same memory being freed twice, leading to undefined behavior. An attacker could potentially craft a malicious input to trigger this vulnerability and execute arbitrary code or crash the system. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected touchpad driver or use an alternative input device until the Kernel update is applied. Disabling the driver can be done by modifying the Kernel configuration or blacklisting the elan module. However, this workaround may impact the functionality of the touchpad, and it is recommended to apply the official fix as soon as possible.
Conclusion
In conclusion, the HID: elan package in the Linux Kernel is vulnerable to a double free issue in the elan_input_configured function. This vulnerability can potentially be exploited to execute arbitrary code or crash the system. It is crucial to update the Kernel to the latest version to apply the necessary fix and mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The HID: elan package is a component of the Linux Kernel that provides drivers for Elan touchpads, enabling their functionality on Linux-based systems.
A double free vulnerability occurs when the same memory is freed twice, leading to undefined behavior. It can be exploited by attackers to execute arbitrary code or crash the system.
This vulnerability can be potentially exploited by crafting a malicious input that triggers the double free issue in the elan_input_configured function of the HID: elan package.
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could allow an attacker to execute arbitrary code or crash the system.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.4.198 or later, which includes the necessary fix for the double free issue.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
