Linux Kernel HID Multitouch Input Device Reference Vulnerability

A use-after-free vulnerability has been addressed in the Linux kernel's HID multitouch driver. The issue arose from incorrectly referencing the input device when allocating the input device name, which could lead to a use-after-free condition. This occurred when the input device was unregistered, freeing the name before it was needed for a uevent. The vulnerability has been fixed by changing the reference to the HID device and using a more straightforward memory allocation method. This vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability could lead to a use-after-free condition, potentially allowing for memory corruption or exploitation of the freed memory.

Reproduction

The vulnerability can be reproduced by using a HID multitouch device that is unregistered while a uevent is fired that depends on the input device name. This sequence will trigger the use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.