HID: usbhid: Fix Information Leak in hid_submit_ctrl
Summary
GSD-2021-1000969: HID: usbhid: fix info leak in hid_submit_ctrl. Affects Kernel versions < b1e3596416d74ce95cc0b7b38472329a3818f8a9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that provides essential services and functionality to the system. It acts as a bridge between the hardware and software layers, facilitating communication and managing resources. The HID (Human Interface Device) subsystem within the Kernel handles input devices such as keyboards, mice, and game controllers. The usbhid module is responsible for managing USB HID devices. This vulnerability, identified as GSD-2021-1000969, affects the usbhid module and can lead to an information leak.
Vulnerability Detail
The vulnerability in the usbhid module, specifically in the hid_submit_ctrl function, allows for an information leak. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data. The function hid_submit_ctrl is responsible for submitting control requests to the USB HID device. However, due to a flaw, it does not properly handle certain error conditions, leading to the potential disclosure of kernel memory. This information leak could provide an attacker with valuable insights into the system's state, potentially aiding in further attacks or privilege escalation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to their Kernel if updating to the latest version is not feasible. The patch can be obtained from the commit b1e3596416d74ce95cc0b7b38472329a3818f8a9 in the Linux Kernel repository. Users can follow the instructions provided in the commit to apply the patch to their Kernel source code and rebuild the Kernel.
Conclusion
The HID: usbhid: Fix Information Leak in hid_submit_ctrl vulnerability in the usbhid module of the Linux Kernel can lead to an information leak, potentially exposing sensitive data. It is crucial to update the Kernel to version v5.10.45 or later to mitigate this vulnerability. Users can also manually apply the provided patch as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability can lead to an information leak, potentially exposing sensitive data and providing attackers with insights into the system's state.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities, including GSD-2021-1000969, are found.
Yes, users can manually apply the patch provided in the commit b1e3596416d74ce95cc0b7b38472329a3818f8a9 to their Kernel source code as a temporary workaround until they can update to the latest Kernel version.
No, this vulnerability requires local access to the system in order to exploit it.
There are no known instances of this vulnerability being exploited in the wild at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
