HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
Summary
GSD-2022-1005934: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report. Affects Kernel versions >= c164d6abf3841ffacfdb757c10616f9cb1f67276, < fa2b822d86be5b5ad54fe4fa2daca464e71ff90a. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the essential services to enable the execution of programs and manages the system's resources. The HID (Human Interface Device) subsystem in the Linux Kernel handles input devices such as keyboards, mice, and game controllers. Steam is a digital distribution platform for video games that utilizes the HID subsystem for input handling. However, a vulnerability has been discovered in the steam_{recv,send}_report functions, which can lead to a NULL pointer dereference.
Vulnerability Detail
The vulnerability in the steam_{recv,send}_report functions of the HID subsystem in the Linux Kernel allows for a NULL pointer dereference. This means that when certain conditions are met, the code attempts to access memory using a pointer that is not pointing to a valid memory location (NULL). This can result in a system crash (kernel panic) or potential privilege escalation if an attacker can control the NULL pointer. The vulnerability was introduced in version v4.18 of the Linux Kernel and has been fixed in version v5.4.212.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to apply the fix by updating the Linux Kernel to the latest version.
Conclusion
In conclusion, the HID: steam: Prevent NULL pointer dereference vulnerability in the Linux Kernel's HID subsystem can lead to system crashes and potential privilege escalation. It is crucial to update the Linux Kernel to version v5.4.212 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is an open-source monolithic Unix-like computer operating system kernel that provides essential services and manages system resources.
The HID subsystem in the Linux Kernel handles input devices such as keyboards, mice, and game controllers.
Steam is a digital distribution platform for video games that utilizes the HID subsystem in the Linux Kernel for input handling.
A NULL pointer dereference occurs when a program attempts to access memory using a pointer that is not pointing to a valid memory location (NULL).
The potential consequences of this vulnerability include system crashes (kernel panics) and potential privilege escalation if an attacker can control the NULL pointer.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
