In the Linux kernel, the following vulnerability has been resolved:
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints.
Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects.
Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernelUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-cross-headersUpgrade kernel-tools-libs-develUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-develUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-develUpgrade kernel-headersUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-develUpgrade kernel-rt-modulesUpgrade kernel-modules-extraUpgrade kernel-docUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-zfcpdumpUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-tools-libsUpgrade kernel-coreUpgrade kernel-develUpgrade kernel-debug-coreUpgrade python3-perfUpgrade kernel-modules | Sep 26, 2024 | Jul 16, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jul 30, 2024 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Jul 16, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Sep 25, 2024 | Jul 16, 2024 |
| Rocky_linux | — | Upgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debug-coreUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade perfUpgrade python3-perfUpgrade kernel-rt-coreUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade kernel-coreUpgrade kernel-rt-debug-kvmUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-modulesUpgrade python3-perf-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-develUpgrade kernel-rt-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-debug-modules-extraUpgrade bpftoolUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-rt-kvmUpgrade kernel-rt-modules | Oct 2, 2024 | Jul 16, 2024 |
| Ubuntu | — | Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15 | Nov 19, 2024 | Jul 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub