A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
The product writes data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2173403 | issue tracking third party advisory |
| https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/id=b12fece4c64857e5fab4290bf01b2e0317a88456 | mailing list patch |
| https://www.openwall.com/lists/osssecurity/2023/01/17/3 | broken link |
| https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html | mailing list |
| https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html | mailing list |
| http://www.openwall.com/lists/oss-security/2023/11/05/2 | mailing list |
| http://www.openwall.com/lists/oss-security/2023/11/05/3 | mailing list |