CVE-2021-46906
published 2024-02-26CVE-2021-46906: In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculating…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix info leak in hid_submit_ctrl
In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.
To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.14.6-1 (bookworm) | linux 5.14.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c5d3c142f2d57d40c55e65d5622d319125a45366 | c5d3c142f2d57d40c55e65d5622d319125a45366 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 41b1e71a2c57366b08dcca1a28b0d45ca69429ce | 41b1e71a2c57366b08dcca1a28b0d45ca69429ce |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8c064eece9a51856f3f275104520c7e3017fc5c0 | 8c064eece9a51856f3f275104520c7e3017fc5c0 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0e280502be1b003c3483ae03fc60dea554fcfa82 | 0e280502be1b003c3483ae03fc60dea554fcfa82 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1 | 7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b1e3596416d74ce95cc0b7b38472329a3818f8a9 | b1e3596416d74ce95cc0b7b38472329a3818f8a9 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 21883bff0fd854e07429a773ff18f1e9658f50e8 | 21883bff0fd854e07429a773ff18f1e9658f50e8 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f | 6be388f4a35d2ce5ef7dbf635a8964a5da7f799f |
| linux | linux_kernel | < 4.4.274 | 4.4.274 |
| linux | linux_kernel | >= 0 < 5.10.46-1 | 5.10.46-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 5.14.6-1 | 5.14.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-258.292 | 4.4.0-258.292 |
| linux | linux_kernel | >= 4.10.0 < 4.14.238 | 4.14.238 |
| linux | linux_kernel | >= 4.15.0 < 4.19.196 | 4.19.196 |
| linux | linux_kernel | >= 4.20.0 < 5.4.127 | 5.4.127 |
| linux | linux_kernel | >= 4.5.0 < 4.9.274 | 4.9.274 |
| linux | linux_kernel | >= 5.11.0 < 5.12.12 | 5.12.12 |
| linux | linux_kernel | >= 5.5.0 < 5.10.45 | 5.10.45 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: info leak in hid_submit_ctrl
vendor_redhat·2024-02-26·CVSS 5.5
CVE-2021-46906 [MEDIUM] CWE-402 kernel: info leak in hid_submit_ctrl
kernel: info leak in hid_submit_ctrl
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix info leak in hid_submit_ctrl
In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.
To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().
A flaw was found in the Linux kernel. This issue is caused by an information leak in hid_submit_ctrl.
Package: kernel (Red Hat Enterprise Linux 6)
Debian
CVE-2021-46906: linux - In the Linux kernel, the following vulnerability has been resolved: HID: usbhid...
vendor_debian·2021·CVSS 5.5
CVE-2021-46906 [MEDIUM] CVE-2021-46906: linux - In the Linux kernel, the following vulnerability has been resolved: HID: usbhid...
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().
Scope: local
bookworm: resolved (fixed in 5.14.6-1)
bullseye: resolved (fixed in 5.10.46-1)
forky: resolved (fixed in 5.14.6-1)
sid: resolved (fixed in 5.14.6-1)
trixie: resolved (fixed
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-08-21·CVSS 5.5
CVE-2024-22099 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux
Kernel contained a race condition, leading to a NULL pointer dereference.
An attacker could possibly use this to cause a denial of service (system
crash). (CVE-2024-22099)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel, leading to a null pointer dereference vulnerability. A
privileged local attacker could use this to possibly cause a denial of
service (system crash). (CVE-2024-24860)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- SuperH RISC architecture;
- User-Mode Linu
GHSA
GHSA-jc66-9qcw-88hp: In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix info leak in hid_submit_ctrl
In hid_submit_ctrl(), the way of c
ghsa_unreviewed·2024-02-26
CVE-2021-46906 [MEDIUM] CWE-668 GHSA-jc66-9qcw-88hp: In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix info leak in hid_submit_ctrl
In hid_submit_ctrl(), the way of c
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix info leak in hid_submit_ctrl
In hid_submit_ctrl(), the way of calculating the report length doesn't
take into account that report->size can be zero. When running the
syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to
calculate transfer_buffer_length as 16384. When this urb is passed to
the usb core layer, KMSAN reports an info leak of 16384 bytes.
To fix this, first modify hid_report_len() to account for the zero
report size case by using DIV_ROUND_UP for the division. Then, call it
from hid_submit_ctrl().
OSV
CVE-2021-46906: In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of cal
osv·2024-02-26·CVSS 5.5
CVE-2021-46906 [MEDIUM] CVE-2021-46906: In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of cal
In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: fix info leak in hid_submit_ctrl In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes. To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0e280502be1b003c3483ae03fc60dea554fcfa82https://git.kernel.org/stable/c/21883bff0fd854e07429a773ff18f1e9658f50e8https://git.kernel.org/stable/c/41b1e71a2c57366b08dcca1a28b0d45ca69429cehttps://git.kernel.org/stable/c/6be388f4a35d2ce5ef7dbf635a8964a5da7f799fhttps://git.kernel.org/stable/c/7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1https://git.kernel.org/stable/c/8c064eece9a51856f3f275104520c7e3017fc5c0https://git.kernel.org/stable/c/b1e3596416d74ce95cc0b7b38472329a3818f8a9https://git.kernel.org/stable/c/c5d3c142f2d57d40c55e65d5622d319125a45366https://git.kernel.org/stable/c/0e280502be1b003c3483ae03fc60dea554fcfa82https://git.kernel.org/stable/c/21883bff0fd854e07429a773ff18f1e9658f50e8https://git.kernel.org/stable/c/41b1e71a2c57366b08dcca1a28b0d45ca69429cehttps://git.kernel.org/stable/c/6be388f4a35d2ce5ef7dbf635a8964a5da7f799fhttps://git.kernel.org/stable/c/7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1https://git.kernel.org/stable/c/8c064eece9a51856f3f275104520c7e3017fc5c0https://git.kernel.org/stable/c/b1e3596416d74ce95cc0b7b38472329a3818f8a9https://git.kernel.org/stable/c/c5d3c142f2d57d40c55e65d5622d319125a45366
2024-02-26
Published