HID: usbhid: Free raw_report buffers in usbhid_stop

Background

The Kernel is a crucial component of the Linux operating system that acts as a bridge between the hardware and software layers. It provides essential functionalities and services to enable the proper functioning of the system. The usbhid module within the Kernel handles USB Human Interface Devices (HID) such as keyboards, mice, and game controllers. It allows communication between these devices and the operating system.

However, a vulnerability has been identified in the usbhid module that can potentially lead to security issues. This vulnerability, with the ID GSD-2021-1001528, specifically affects the usbhid_stop function, which is responsible for stopping the usbhid module and freeing resources.

The vulnerability arises from a failure to properly free raw_report buffers in the usbhid_stop function. This can result in memory leaks and potential exploitation by malicious actors. The impact and attack plausibility of this vulnerability have not been proven yet.

Vulnerability Detail

The vulnerability in the usbhid module occurs due to the improper handling of raw_report buffers in the usbhid_stop function. When the usbhid module is stopped, it fails to release these buffers, leading to memory leaks. Although the exact consequences and attack vectors are not yet confirmed, the presence of memory leaks can potentially be exploited by attackers to gain unauthorized access, execute arbitrary code, or cause denial-of-service conditions.

The vulnerability has been assigned the ID GSD-2021-1001528 and has been fixed in the Linux Kernel version v4.14.249 by commit c3156fea4d8a0e643625dff69a0421e872d1fdae.

Workaround

As a workaround, users can apply a patch or backport the fix to their current Kernel version. The patch should ensure that raw_report buffers are correctly freed in the usbhid_stop function. Here is an example of a patch that addresses the vulnerability:

--- a/drivers/hid/usbhid/usbhid-core.c
+++ b/drivers/hid/usbhid/usbhid-core.c
@@ -1234,6 +1234,7 @@ static void usbhid_stop(struct usb_interface *intf)
 		usbhid->ll_driver->close(usbhid);
 		usbhid->ll_driver = NULL;
 	}
+	kfree(usbhid->raw_report);
 }

Please note that applying patches or backporting fixes requires knowledge and experience in Kernel development. It is recommended to consult official documentation or seek assistance from Kernel experts.

Conclusion

The usbhid module in the Linux Kernel is vulnerable to a memory leak issue when stopping the module. This vulnerability, with the ID GSD-2021-1001528, can potentially be exploited by attackers to gain unauthorized access or cause other security issues. To mitigate this vulnerability, it is crucial to update the Kernel to version v4.14.249 or later, which includes the necessary fix. Alternatively, users can apply a patch or backport the fix to their current Kernel version. For further support on vulnerability remediation, you can reach out to DevNack.com.

See every vulnerability recorded for Kernel →

FAQ