CVE-2023-53454

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= c08d46aa805ba46d501f610c2448d07bea979780 < ac0d389402a6ff9ad92cea02c2d8c711483b91ab, >= c08d46aa805ba46d501f610c2448d07bea979780 < 39c70c19456e50dcb3abfe53539220dff0490f1d, >= c08d46aa805ba46d501f610c2448d07bea979780 < df7ca43fe090e1a56c216c8ebc106ef5fd49afc6, >= c08d46aa805ba46d501f610c2448d07bea979780 < 15ec7cb55e7d88755aa01d44a7a1015a42bfce86, >= c08d46aa805ba46d501f610c2448d07bea979780 < dde88ab4e45beb60b217026207aa9c14c88d71ab, >= c08d46aa805ba46d501f610c2448d07bea979780 < 2763732ec1e68910719c75b6b896e11b6d3d622b, >= c08d46aa805ba46d501f610c2448d07bea979780 < 1d7833db9fd118415dace2ca157bfa603dec9c8c, >= c08d46aa805ba46d501f610c2448d07bea979780 < b70ac7849248ec8128fa12f86e3655ba38838f29, >= c08d46aa805ba46d501f610c2448d07bea979780 < 4794394635293a3e74591351fff469cea7ad15a2, >= 3.12, >= 3.12 < 4.14.326, >= 4.15 < 4.19.295, >= 4.20 < 5.4.257, >= 5.5 < 5.10.195, >= 5.11 < 5.15.132, >= 5.16 < 6.1.53, >= 6.2 < 6.4.16, >= 6.5 < 6.5.3

Fixed versions

4.14.326, 4.19.295, 5.4.257, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416