kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/input/tablet
History
Seungjin Bae 015b719962 Input: pegasus-notetaker - fix potential out-of-bounds access 
[ Upstream commit 69aeb50731 ]

In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.

Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.

Fixes: 1afca2b66a ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-12-07 06:09:33 +09:00
..
acecad.c Input: remove third argument of usb_maxpacket() 2025-12-07 06:09:33 +09:00
aiptek.c Input: aiptek - properly check endpoint type 2022-03-23 09:16:43 +01:00
hanwang.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
kbtab.c Input: kbtab - sanity check for endpoint type 2019-08-01 10:55:21 -07:00
Kconfig Input: gtco - remove driver 2020-12-09 17:47:36 -08:00
Makefile Input: gtco - remove driver 2020-12-09 17:47:36 -08:00
pegasus_notetaker.c Input: pegasus-notetaker - fix potential out-of-bounds access 2025-12-07 06:09:33 +09:00
wacom_serial4.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00