HID Core Vulnerability in Linux Kernel Affecting Generic Input Devices

CVE-2024-57986

Summary

A vulnerability exists in the HID core of the Linux kernel related to the handling of Resolution Multipliers. An oversight in the hid_apply_multiplier function, which assumes that every Resolution Multiplier control is contained within a Logical Collection, poses significant risks. If no Logical Collection is defined, the code fails to adequately handle the resolution multiplier, leading to potential exploits. This was identified as part of a 2019 report by the syzbot fuzzer. To mitigate this issue, the core must correctly manage the state of the multiplier_collection pointer when a valid Logical Collection is not found.

References