CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's hid-goodix-spi driver, which fails to properly validate the size of incoming report data, leading to a potential stack buffer overflow. This flaw allows attackers to exploit the driver by sending oversized reports, which could result in arbitrary code execution or system crashes. Organizations using Linux systems with this driver should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set hid_ll_driver.max_buffer_size and performs no bounds checking before copying the payload: memcpy(tmp_buf + tx_len, buf, len); A hidraw SET_REPORT ioctl with a report larger than ~116 bytes overflows the stack buffer. Add a size check after constructing the header, rejecting reports that would exceed the buffer capacity. Discovered by Atuin - Automated Vulnerability Discovery Engine.