HID: mcp2221: validate report size in mcp2221_raw_event() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 13 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3] as the copy length without checking that 4 + data[3] bytes actually exist in the received report. A malicious or misbehaving USB device can send a short report with a large data[3], causing the memcpy to read past the valid report data in the HID transfer buffer and leak uninitialized kernel memory back to userspace through the I2C/SMBus read path. Add a minimum size check at entry and validate that the source range fits within the received report before the copy.
Références
- https://git.kernel.org/stable/c/cb38b1f149b7143355b37e86c841acf0076e5c2a
- https://git.kernel.org/stable/c/b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d
- https://git.kernel.org/stable/c/fffcfa367072628c3144cca17d2a3c3c9e50c057
- https://git.kernel.org/stable/c/c1c508e8923911cb458234997e55b7a4b9aa066f
- https://git.kernel.org/stable/c/bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149
- https://git.kernel.org/stable/c/127de5919820f88a9d55e8371ad4ac49f625f4c5
- https://git.kernel.org/stable/c/7c18fb36708a97ff6772825cc087b6d537bbf0d5
- https://git.kernel.org/stable/c/2c9a6998c19503626c57a2267bf279e204113079
Références européennes
- ENISA EUVD · EUVD-2026-76533
- GCVE · GCVE-0-2026-89621
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 67a95c21463d066060b0f66d65a75d45bb386ffb < cb38b1f149b7143355b37e86c841acf0076e5c2a ; affected 67a95c21463d066060b0f66d65a75d45bb386ffb < b2c67dc0e30c308647bbd9b9e5d69a44c9d2733d ; affected 67a95c21463d066060b0f66d65a75d45bb386ffb < fffcfa367072628c3144cca17d2a3c3c9e50c057 ; affected 67a95c21463d066060b0f66d65a75d45bb386ffb < c1c508e8923911cb458234997e55b7a4b9aa066f ; affected 67a95c21463d066060b0f66d65a75d45bb386ffb < bdc6a3af0dd734a326acdb7d6401a3b6a9f4f149 ; affected 67a95c21463d066060b0f66d65a75d45bb386ffb < 127de5919820f88a9d55e8371ad4ac49f625f4c5 |
| Linux · Linux | affected 5.7 ; unaffected 0 < 5.7 ; unaffected 5.10.270 ≤ 5.10.* ; unaffected 5.15.221 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |