In the Linux kernel, the following vulnerability has been resolved:
Input: elantech - fix stack out of bound access in elantech_change_report_id()
The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN:
[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118
[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 [ 6.512436] Workqueue: events_long serio_handle_event [ 6.512453] Call Trace: [ 6.512462] show_stack+0x52/0x58 [ 6.512474] dump_stack+0xa1/0xd3 [ 6.512487] print_address_description.constprop.0+0x1d/0x140 [ 6.512502] ? __ps2_command+0x372/0x7e0 [ 6.512516] __kasan_report.cold+0x7d/0x112 [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 [ 6.512539] ? __ps2_command+0x372/0x7e0 [ 6.512552] kasan_report+0x3c/0x50 [ 6.512564] __asan_load1+0x6a/0x70 [ 6.512575] __ps2_command+0x372/0x7e0 [ 6.512589] ? ps2_drain+0x240/0x240 [ 6.512601] ? dev_printk_emit+0xa2/0xd3 [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 [ 6.512621] ? __kasan_check_write+0x14/0x20 [ 6.512634] ? mutex_lock+0x8f/0xe0 [ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 [ 6.512655] ps2_command+0x52/0x90 [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] [ 6.512863] ? ps2_command+0x7f/0x90 [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] [ 6.513122] ? phys_pmd_init+0x30e/0x521 [ 6.513137] elantech_init+0x8a/0x200 [psmouse] [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] [ 6.513519] ? mutex_unlock+0x22/0x40 [ 6.513526] ? ps2_command+0x7f/0x90 [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] [ 6.513624] psmouse_connect+0x272/0x530 [psmouse] [ 6.513669] serio_driver_probe+0x55/0x70 [ 6.513679] really_probe+0x190/0x720 [ 6.513689] driver_probe_device+0x160/0x1f0 [ 6.513697] device_driver_attach+0x119/0x130 [ 6.513705] ? device_driver_attach+0x130/0x130 [ 6.513713] __driver_attach+0xe7/0x1a0 [ 6.513720] ? device_driver_attach+0x130/0x130 [ 6.513728] bus_for_each_dev+0xfb/0x150 [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 [ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 [ 6.513757] driver_attach+0x2d/0x40 [ 6.513764] serio_handle_event+0x199/0x3d0 [ 6.513775] process_one_work+0x471/0x740 [ 6.513785] worker_thread+0x2d2/0x790 [ 6.513794] ? process_one_work+0x740/0x740 [ 6.513802] kthread+0x1b4/0x1e0 [ 6.513809] ? set_kthread_struct+0x80/0x80 [ 6.513816] ret_from_fork+0x22/0x30
[ 6.513832] The buggy address belongs to the page: [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 6.513860] raw: 0 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rtUpgrade bpftoolUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debugUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-develUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernelUpgrade kernel-cross-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-debugUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-core | Sep 26, 2024 | Mar 4, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.93-87.444Upgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade perfUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfo | Aug 2, 2024 | Mar 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 4, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Mar 4, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 25, 2024 | Mar 4, 2024 |
| Rocky_linux | — | Upgrade kernel-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-rt-develUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-rt-coreUpgrade kernel-develUpgrade kernel-rt-modulesUpgrade kernel-debug-debuginfoUpgrade bpftoolUpgrade kernel-rt-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-headersUpgrade perfUpgrade kernel-rt-debug-develUpgrade perf-debuginfoUpgrade kernel-rt-debug-kvm | Oct 2, 2024 | Mar 4, 2024 |
| Suse | — | Upgrade kernel-default-extraUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade kernel-preemptUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade dtb-freescaleUpgrade cluster-md-kmp-azureUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade dtb-amdUpgrade reiserfs-kmp-rtUpgrade dtb-rockchipUpgrade kernel-preempt-develUpgrade kernel-rt-livepatchUpgrade kernel-default-livepatch-develUpgrade kernel-source-vanillaUpgrade dtb-armUpgrade dtb-renesasUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade dtb-appleUpgrade dtb-nvidiaUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade kernel-rt_debugUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-azure-extraUpgrade kselftests-kmp-rtUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-debugUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade dtb-marvellUpgrade dlm-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-default-baseUpgrade kernel-rt-extraUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-apmUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-livepatchUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade kernel-azure-develUpgrade kernel-azure-optionalUpgrade kernel-azure-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amlogicUpgrade kernel-symsUpgrade dtb-broadcomUpgrade kernel-kvmsmallUpgrade dtb-alteraUpgrade kernel-macrosUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade dtb-mediatekUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-64kb | Aug 9, 2024 | Mar 4, 2024 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-ibm-5.4Upgrade linuxUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linux-gkeopUpgrade linux-raspiUpgrade linux-fipsUpgrade linux-ibmUpgrade linux-oracle-5.4Upgrade linux-kvmUpgrade linux-oracle | Nov 19, 2024 | Mar 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub