Описание
In the Linux kernel, the following vulnerability has been resolved:
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
Make finger2 (and also finger1) unsigned, so that if the finger index in
the packet is 0 then subtracting 1 creates an array index which overflows
above the existing check for FOC_MAX_FINGERS, as the existing comment says
it should, instead of writing to state->fingers[-1].
A flaw was found in the Linux kernel's focaltech input driver. This vulnerability occurs in the focaltech_process_rel_packet function, where incorrect handling of input can lead to an array out-of-bounds write. This memory corruption issue could potentially allow an attacker to cause system instability or execute arbitrary code.
Отчет
A moderate out-of-bounds write flaw was found in the Linux kernel's FocalTech touchpad driver as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and in Red Hat In-Vehicle Operating System (RHIVOS) 2.0 and 2.1 (kernel, kernel-rt, and kernel-ivos-qualcomm). In focaltech_process_rel_packet(), when a finger index of 0 is read from a device packet and decremented, the signed result (-1) bypasses the existing FOC_MAX_FINGERS bounds check and writes to state->fingers[-1], corrupting kernel memory immediately before the array. A local attacker able to submit crafted input on a system with an affected FocalTech touchpad device could use this flaw to corrupt kernel memory, most realistically causing a kernel panic and denial of service. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those kernel versions. The fix for affected releases is deferred to a future regularly scheduled kernel update; the residual risk is limited to local availability impact, or targeted memory corruption, on systems that use the affected FocalTech driver, since exploitation requires both local access and such hardware. The Red Hat severity of moderate (CVSS 5.5) differs from the upstream CVEORG rating of important (CVSS 8.4) because the Red Hat assessment reflects the local attack vector and the constrained nature of the write, whose primary impact is on availability rather than broad confidentiality and integrity.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
In the Linux kernel, the following vulnerability has been resolved: I ...
In the Linux kernel, the following vulnerability has been resolved: Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet Make finger2 (and also finger1) unsigned, so that if the finger index in the packet is 0 then subtracting 1 creates an array index which overflows above the existing check for FOC_MAX_FINGERS, as the existing comment says it should, instead of writing to state->fingers[-1].
EPSS
5.5 Medium
CVSS3