Linux Kernel Usbtouchscreen Driver Out-of-Bounds Read Vulnerability in NEXIO Data Handling

A vulnerability has been identified in the Linux kernel's usbtouchscreen driver, specifically in the handling of NEXIO data within the interrupt packet. The issue arises because the driver does not properly validate the length of the data being read, allowing for a significant out-of-bounds read of approximately 64 KiB. This read extends beyond the allocated buffer, potentially leaking adjacent kernel memory into userspace as touch coordinate events. The vulnerability can be exploited by a device that falsely reports its data length, bypassing the driver's existing length checks. The issue affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability leads to an out-of-bounds read, causing a memory leak from the kernel to userspace. This leak can include sensitive information from adjacent kernel memory, which is exposed as touch coordinate events. Additionally, the out-of-bounds read can reach an unmapped page, causing a fault.

Reproduction

The vulnerability can be reproduced by using a device that communicates with the usbtouchscreen driver and intentionally sends NEXIO data with a manipulated length. The driver will then read beyond the allocated buffer, causing a memory leak from the kernel to userspace.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been addressed. Instructions for downloading the patched version are available on the official Linux kernel website.