Linux Kernel Wacom HID Driver Out-of-Bounds Write Vulnerability

A vulnerability has been identified in the Linux kernel's Wacom HID driver, specifically in the function wacom_hid_set_device_mode(). The issue arises because the function incorrectly assumes that the HID_DG_INPUTMODE usage is always in the first field of the feature report. In reality, this usage can be in a different field. If it is not in the first field and the first field's report count is smaller than the usage index of HID_DG_INPUTMODE, an out-of-bounds write occurs. This vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to an out-of-bounds write, which can potentially be used to overwrite memory locations and cause undefined behavior, such as executing arbitrary code or crashing the system.

Reproduction

To reproduce this vulnerability, use a Wacom device that specifies HID_DG_INPUTMODE in a field other than the first one. The first field must have a report count smaller than the usage index of HID_DG_INPUTMODE. When the device is used, the wacom_hid_set_device_mode() function will attempt to write to the first field, causing an out-of-bounds write.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux documentation.