Bug 1974491 (CVE-2021-0512) - CVE-2021-0512 kernel: out-of-bounds write due to a heap buffer overflow in __hidinput_change_resolution_multipliers() of hid-input.c
Summary: CVE-2021-0512 kernel: out-of-bounds write due to a heap buffer overflow in __...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-0512
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1978234 1978235 1978237 1978239 1974492 1974934 1974935 1974936 1974938 1974939 1974940 1974941 1974942 1974943 1974944 1974945 1974946 1974947 1974948 1975124 1979026 1979027 1979028 1979029 2003056
Blocks: 1974493
TreeView+ depends on / blocked
 
Reported: 2021-06-21 20:07 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-17 21:27 UTC (History)
59 users (show)

Fixed In Version: Linux kernel 5.12-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw out of bounds memory write in the Linux kernel HID subsystem was found in the way user attach USB or other HID device that generates incorrect data inside HID report field. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2021-09-07 20:33:21 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3443 0 None None None 2021-09-07 15:07:02 UTC
Red Hat Product Errata RHSA-2021:3445 0 None None None 2021-09-07 15:14:20 UTC
Red Hat Product Errata RHSA-2021:3446 0 None None None 2021-09-07 16:46:53 UTC
Red Hat Product Errata RHSA-2021:4056 0 None None None 2021-11-02 08:42:59 UTC
Red Hat Product Errata RHSA-2021:4088 0 None None None 2021-11-02 09:52:22 UTC
Red Hat Product Errata RHSA-2021:4122 0 None None None 2021-11-03 16:12:56 UTC
Red Hat Product Errata RHSA-2021:4750 0 None None None 2021-11-19 19:21:48 UTC

Description Guilherme de Almeida Suckevicz 2021-06-21 20:07:15 UTC 
In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

References:
https://source.android.com/security/bulletin/2021-06-01
https://android.googlesource.com/kernel/common/+/ed9be64eefe2
Comment 1 Guilherme de Almeida Suckevicz 2021-06-21 20:07:53 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1974492]
Comment 5 Justin M. Forbes 2021-06-29 15:55:32 UTC 
This was fixed for Fedora with the 5.10.19 stable kernel updates.
Comment 9 errata-xmlrpc 2021-09-07 15:06:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3443 https://access.redhat.com/errata/RHSA-2021:3443
Comment 10 errata-xmlrpc 2021-09-07 15:14:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3445 https://access.redhat.com/errata/RHSA-2021:3445
Comment 11 errata-xmlrpc 2021-09-07 16:46:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2021:3446 https://access.redhat.com/errata/RHSA-2021:3446
Comment 12 Product Security DevOps Team 2021-09-07 20:33:21 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-0512
Comment 13 errata-xmlrpc 2021-11-02 08:42:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4056 https://access.redhat.com/errata/RHSA-2021:4056
Comment 14 errata-xmlrpc 2021-11-02 09:52:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4088 https://access.redhat.com/errata/RHSA-2021:4088
Comment 15 errata-xmlrpc 2021-11-03 16:12:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4122 https://access.redhat.com/errata/RHSA-2021:4122
Comment 16 errata-xmlrpc 2021-11-19 19:21:45 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Via RHSA-2021:4750 https://access.redhat.com/errata/RHSA-2021:4750
Note You need to log in before you can comment on or make changes to this bug.