In the Linux kernel, the following vulnerability has been resolved:
Input: elantech - fix stack out of bound access in elantech_change_report_id()
The array param[] in elantech_change_report_id() must be at least 3 bytes, because elantech_read_reg_params() is calling ps2_command() with PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but it's defined in the stack as an array of 2 bytes, therefore we have a potential stack out-of-bounds access here, also confirmed by KASAN:
[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 [ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118
[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 [ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 [ 6.512436] Workqueue: events_long serio_handle_event [ 6.512453] Call Trace: [ 6.512462] show_stack+0x52/0x58 [ 6.512474] dump_stack+0xa1/0xd3 [ 6.512487] print_address_description.constprop.0+0x1d/0x140 [ 6.512502] ? __ps2_command+0x372/0x7e0 [ 6.512516] __kasan_report.cold+0x7d/0x112 [ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 [ 6.512539] ? __ps2_command+0x372/0x7e0 [ 6.512552] kasan_report+0x3c/0x50 [ 6.512564] __asan_load1+0x6a/0x70 [ 6.512575] __ps2_command+0x372/0x7e0 [ 6.512589] ? ps2_drain+0x240/0x240 [ 6.512601] ? dev_printk_emit+0xa2/0xd3 [ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 [ 6.512621] ? __kasan_check_write+0x14/0x20 [ 6.512634] ? mutex_lock+0x8f/0xe0 [ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 [ 6.512655] ps2_command+0x52/0x90 [ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] [ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] [ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] [ 6.512863] ? ps2_command+0x7f/0x90 [ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] [ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] [ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] [ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] [ 6.513122] ? phys_pmd_init+0x30e/0x521 [ 6.513137] elantech_init+0x8a/0x200 [psmouse] [ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] [ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] [ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] [ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] [ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] [ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] [ 6.513519] ? mutex_unlock+0x22/0x40 [ 6.513526] ? ps2_command+0x7f/0x90 [ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] [ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] [ 6.513624] psmouse_connect+0x272/0x530 [psmouse] [ 6.513669] serio_driver_probe+0x55/0x70 [ 6.513679] really_probe+0x190/0x720 [ 6.513689] driver_probe_device+0x160/0x1f0 [ 6.513697] device_driver_attach+0x119/0x130 [ 6.513705] ? device_driver_attach+0x130/0x130 [ 6.513713] __driver_attach+0xe7/0x1a0 [ 6.513720] ? device_driver_attach+0x130/0x130 [ 6.513728] bus_for_each_dev+0xfb/0x150 [ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 [ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 [ 6.513757] driver_attach+0x2d/0x40 [ 6.513764] serio_handle_event+0x199/0x3d0 [ 6.513775] process_one_work+0x471/0x740 [ 6.513785] worker_thread+0x2d2/0x790 [ 6.513794] ? process_one_work+0x740/0x740 [ 6.513802] kthread+0x1b4/0x1e0 [ 6.513809] ? set_kthread_struct+0x80/0x80 [ 6.513816] ret_from_fork+0x22/0x30
[ 6.513832] The buggy address belongs to the page: [ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 [ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) [ 6.513860] raw: 0 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-develUpgrade kernel-docUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rtUpgrade perfUpgrade kernel-rt-debugUpgrade kernel-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade python3-perfUpgrade kernel-debugUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-kvm | Sep 26, 2024 | Mar 4, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade kernel-tools-develUpgrade python-perfUpgrade perfUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.93-87.444Upgrade kernelUpgrade bpftoolUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-debuginfo | Aug 2, 2024 | Mar 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 4, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Mar 4, 2024 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Sep 25, 2024 | Mar 4, 2024 |
| Rocky_linux | — | Upgrade kernel-rtUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-modulesUpgrade kernel-coreUpgrade bpftoolUpgrade kernelUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debug-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debugUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-debug-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade kernel-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-develUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-debug-modulesUpgrade bpftool-debuginfoUpgrade kernel-rt-debuginfo | Oct 2, 2024 | Mar 4, 2024 |
| Suse | — | Upgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade gfs2-kmp-azureUpgrade kernel-debugUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-default-optionalUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade dtb-lgUpgrade dtb-apmUpgrade reiserfs-kmp-azureUpgrade dtb-exynosUpgrade kernel-kvmsmall-vdsoUpgrade dtb-broadcomUpgrade ocfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade kernel-debug-livepatch-develUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade kernel-syms-azureUpgrade dtb-qcomUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-symsUpgrade kernel-sourceUpgrade kernel-default-develUpgrade dtb-mediatekUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade dtb-freescaleUpgrade kernel-default-base-rebuildUpgrade kernel-default-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-preemptUpgrade kernel-syms-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-docs-htmlUpgrade dtb-xilinxUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade dtb-renesasUpgrade dtb-armUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-64kb-extraUpgrade kernel-preempt-develUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-devel-rtUpgrade dtb-socionextUpgrade dtb-hisiliconUpgrade kernel-azureUpgrade reiserfs-kmp-rtUpgrade dtb-rockchipUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade kselftests-kmp-rtUpgrade dtb-allwinnerUpgrade kselftests-kmp-default | Aug 9, 2024 | Mar 4, 2024 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-oracle-5.4Upgrade linux-oracleUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-gkeopUpgrade linux-bluefieldUpgrade linuxUpgrade linux-azureUpgrade linux-hwe-5.4Upgrade linux-ibm-5.4Upgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-gcp-5.4Upgrade linux-raspi-5.4Upgrade linux-gcp | Nov 19, 2024 | Mar 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub