Bug 1974491 (CVE-2021-0512) - CVE-2021-0512 kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c
Summary: CVE-2021-0512 kernel: out-of-bounds write due to a heap buffer overflow in __...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-0512
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1978234 Red Hat1978235 Red Hat1978237 Red Hat1978239 1974492 Red Hat1974934 Red Hat1974935 Red Hat1974936 Red Hat1974938 Red Hat1974939 Red Hat1974940 Red Hat1974941 Red Hat1974942 Red Hat1974943 Red Hat1974944 Red Hat1974945 Red Hat1974946 Red Hat1974947 Red Hat1974948 Engineering1975124 Red Hat1979026 Red Hat1979027 Red Hat1979028 Red Hat1979029 Red Hat2003056
Blocks: Embargoed1974493
TreeView+ depends on / blocked
 
Reported: 2021-06-21 20:07 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-17 21:27 UTC (History)
59 users (show)

Fixed In Version: Linux kernel 5.12-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw out of bounds memory write in the Linux kernel HID subsystem was found in the way user attach USB or other HID device that generates incorrect data inside HID report field. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2021-09-07 20:33:21 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3443 0 None None None 2021-09-07 15:07:02 UTC
Red Hat Product Errata RHSA-2021:3445 0 None None None 2021-09-07 15:14:20 UTC
Red Hat Product Errata RHSA-2021:3446 0 None None None 2021-09-07 16:46:53 UTC
Red Hat Product Errata RHSA-2021:4056 0 None None None 2021-11-02 08:42:59 UTC
Red Hat Product Errata RHSA-2021:4088 0 None None None 2021-11-02 09:52:22 UTC
Red Hat Product Errata RHSA-2021:4122 0 None None None 2021-11-03 16:12:56 UTC
Red Hat Product Errata RHSA-2021:4750 0 None None None 2021-11-19 19:21:48 UTC

Description Guilherme de Almeida Suckevicz 2021-06-21 20:07:15 UTC 
In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References:
https://source.android.com/security/bulletin/2021-06-01
https://android.googlesource.com/kernel/common/+/ed9be64eefe2
Comment 1 Guilherme de Almeida Suckevicz 2021-06-21 20:07:53 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1974492]
Comment 5 Justin M. Forbes 2021-06-29 15:55:32 UTC 
This was fixed for Fedora with the 5.10.19 stable kernel updates.
Comment 9 errata-xmlrpc 2021-09-07 15:06:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3443 https://access.redhat.com/errata/RHSA-2021:3443
Comment 10 errata-xmlrpc 2021-09-07 15:14:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3445 https://access.redhat.com/errata/RHSA-2021:3445
Comment 11 errata-xmlrpc 2021-09-07 16:46:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3446 https://access.redhat.com/errata/RHSA-2021:3446
Comment 12 Product Security DevOps Team 2021-09-07 20:33:21 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-0512
Comment 13 errata-xmlrpc 2021-11-02 08:42:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4056 https://access.redhat.com/errata/RHSA-2021:4056
Comment 14 errata-xmlrpc 2021-11-02 09:52:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4088 https://access.redhat.com/errata/RHSA-2021:4088
Comment 15 errata-xmlrpc 2021-11-03 16:12:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4122 https://access.redhat.com/errata/RHSA-2021:4122
Comment 16 errata-xmlrpc 2021-11-19 19:21:45 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:4750 https://access.redhat.com/errata/RHSA-2021:4750
Note You need to log in before you can comment on or make changes to this bug.