Bug 1516232 (CVE-2017-16643)

Summary:	CVE-2017-16643 kernel: Out-of-bounds read in drivers/input/tablet/gtco.c
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agordeev, airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, esammons, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jcline, jeremy, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, steved, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.14	Doc Type:	If docs needed, set a value
Doc Text:	The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel, before 4.13.11, allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-11-27 15:25:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1516274
Bug Blocks:	1516236

Description Andrej Nemec 2017-11-22 10:36:30 UTC

The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.

References:

https://groups.google.com/forum/#!msg/syzkaller/McWFcOsA47Y/3bjtBBgaBAAJ

http://seclists.org/oss-sec/2017/q4/392

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a50829479f58416a013a4ccca791336af3c584c7

Comment 1 Andrej Nemec 2017-11-22 11:54:05 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1516274]

Comment 2 Jeremy Cline 2017-11-27 15:25:25 UTC

Fixed in kernel v4.13.11

Comment 5 Vladis Dronov 2018-02-24 15:26:42 UTC

Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, as a code with the flaw is not present or is not built in the products listed.

This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.