HID: usbhid: free raw_report buffers in usbhid_stop
Summary
GSD-2021-1001586: HID: usbhid: free raw_report buffers in usbhid_stop. Affects Kernel versions < 965147067fa1bedff3ae1f07ce3f89f1a14d2df3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The HID (Human Interface Device) subsystem in the Linux Kernel provides support for various input devices such as keyboards, mice, and game controllers. The usbhid module is responsible for handling USB HID devices. It allows communication between the kernel and the HID devices connected via USB. The usbhid_stop function is used to stop the usbhid module and release any resources associated with it.
Vulnerability Detail
The vulnerability identified as GSD-2021-1001586 in the usbhid module of the Linux Kernel allows for potential security issues. Specifically, the raw_report buffers are not properly freed in the usbhid_stop function. This can lead to memory leaks and potential exploitation by an attacker. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The HID usbhid module in the Linux Kernel has a vulnerability that can lead to memory leaks and potential security issues. It is recommended to update the Linux Kernel to version v5.4.151 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven. However, if successfully exploited, it could lead to memory leaks and potential security issues.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it in real-time.
There is no known exploit for this vulnerability at the moment. However, it is important to apply the fix as soon as possible to mitigate any potential risks.
It is recommended to update the Linux Kernel to the fixed version rather than manually patching the vulnerability. This ensures that you have the latest security updates and fixes for other potential vulnerabilities as well.
You can find more information about this vulnerability in the GSD-2021-1001586.json file available in the GSD database on GitHub: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1001xxx/GSD-2021-1001586.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
