Riskcovery

CVE-2021-46906

HID: usbhid: fix info leak in hid_submit_ctrl

State
Published
Severity
Not scored
Published
Feb 26, 2024
Updated
May 11, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: usbhid: fix info leak in hid_submit_ctrl

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c5d3c142f2d57d40c55e65d5622d319125a45366Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 41b1e71a2c57366b08dcca1a28b0d45ca69429ceAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8c064eece9a51856f3f275104520c7e3017fc5c0Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0e280502be1b003c3483ae03fc60dea554fcfa82Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f5a4b24cdbd7372770a02f23e347d7d9a9ac8f1Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b1e3596416d74ce95cc0b7b38472329a3818f8a9Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 21883bff0fd854e07429a773ff18f1e9658f50e8Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6be388f4a35d2ce5ef7dbf635a8964a5da7f799fAffected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 4.4.274 through 4.4.*Not affected
  • 4.9.274 through 4.9.*Not affected
  • 4.14.238 through 4.14.*Not affected
  • 4.19.196 through 4.19.*Not affected
  • 5.4.127 through 5.4.*Not affected
  • 5.10.45 through 5.10.*Not affected
  • 5.12.12 through 5.12.*Not affected
  • 5.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.