In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_rel…
High CVSS 8.8
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix out-of-bounds bit access on mt_io_flags mt_io_flags is a single unsigned long, but mt_process_slot(), mt_release_pending_palms() and mt_release_contacts() use it as a per-slot bitmap indexed by the slot number. That slot number is only bounded by td->maxcontacts, which is taken from the device's ContactCountMaximum feature report and can be up to 255, not by BITS_PER_LONG. As a result, a multitouch devic…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55
- https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75
- https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d
- https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22
- https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be
- https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d
- https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8
- https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4
Timeline
- nvd_ingest NVD