NetSight
IP …
high7.8

CVE-2023-54207

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID d…

Impact

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.1 before 5.10.249
from 5.11 before 5.15.199
from 5.16 before 6.1.53
from 6.2 before 6.4.16
from 6.5 before 6.5.3

Weakness classification

CWE-416

References