CVE-2021-46906

In hid_submit_ctrl(), the way of calculating the report length doesn't take into account that report->size can be zero. When running the syzkaller reproducer, a report of size 0 causes hid_submit_ctrl) to calculate transfer_buffer_length as 16384. When this urb is passed to the usb core layer, KMSAN reports an info leak of 16384 bytes.

To fix this, first modify hid_report_len() to account for the zero report size case by using DIV_ROUND_UP for the division. Then, call it from hid_submit_ctrl().

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-46906.json"

unresolved_ranges

[
    {
        "events":  [
            {
                "introduced":  "0"
            },
            {
                "fixed":  "4.4.274"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "4.5.0"
            },
            {
                "fixed":  "4.9.274"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "4.10.0"
            },
            {
                "fixed":  "4.14.238"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "4.15.0"
            },
            {
                "fixed":  "4.19.196"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "4.20.0"
            },
            {
                "fixed":  "5.4.127"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "5.5.0"
            },
            {
                "fixed":  "5.10.45"
            }
        ]
    },
    {
        "events":  [
            {
                "introduced":  "5.11.0"
            },
            {
                "fixed":  "5.12.12"
            }
        ]
    }
]