In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "102365989671319969167312359585959806819", "256226433835068931272883394441385349342", "69594018806824216392710014893787353062", "310005376971656420161450717480224640884" ] }, "id": "ASB-A-162844689-0154ae60", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-input.c" }, "signature_type": "Line" }, { "digest": { "length": 508.0, "function_hash": "55578438920159690211795793681720948871" }, "id": "ASB-A-162844689-13821ddb", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "include/linux/hid.h", "function": "hid_map_usage" }, "signature_type": "Function" }, { "digest": { "length": 18936.0, "function_hash": "303347000737440041019729659778639181447" }, "id": "ASB-A-162844689-2667b5aa", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-input.c", "function": "hidinput_configure_usage" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "59279288054240772512122037148835217342", "211880442018003413039781699765869659646", "214310009365619240478923272630953271789", "321971145287701039621919956120198388347", "207959965809916909403245645649888378685", "188374904451562885539951987849272656462", "319458721325611379528885337716549284009", "104733734344321184961195836625682850135", "31016265555568093321704658062067679381", "122010839418486169462622783824556336648", "107437023064454477683088389321012772659" ] }, "id": "ASB-A-162844689-2b4cf815", "source": "https://android.googlesource.com/kernel/common/+/bce1305c0ece", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-core.c", "truncated_path_level": 1.0 }, "signature_type": "Line" }, { "digest": { "length": 300.0, "function_hash": "302779128589865924941927860846474042040" }, "id": "ASB-A-162844689-2ddc193a", "source": "https://android.googlesource.com/kernel/common/+/bce1305c0ece", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-core.c", "truncated_path_level": 1.0, "function": "hid_output_report" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "268055632556910503923875141730196633634", "57842140175800143513561002722837030009", "256062987324063829249436965411459279206", "147278818551671722688212723285383025825", "29755966740229660384180370909930096114", "266097888082620232400605402951797651461", "185810399974896165757814216270507984909", "55400478342322733729429207564647460027", "247347180192186869385553530003717595827", "157459159319754425538474102118902065284", "29494113422508613892724450904734445976", "303050258295120181445751865994683976355", "213639026524475620781058014780369331033", "282468499377987417238053493939301100993", "336608151542312175675351087751364996743", "97971238702193589345732511247533277637", "19460741356470950011857173442175201888", "247467676171329814373778027005659413946", "170384993852410580444714391441571494691", "196738303956343381626463119174943967446", "153119831316232186570814379757003047523", "32418120173644714942941004303895777690", "137754374682385105452796713601045978495", "292950906428407360827043744764976131146", "91663775131754493790445123261892556958", "174358616378820449793364132421792797121", "70402711916233663845160579785439826944", "328128316290640555281790508825598557477", "223362990571047449891577900360425635873", "115401233118418846040907247466396039538", "208216904010377305567462870482572643187", "74941520705711958706001710257800292838" ] }, "id": "ASB-A-162844689-5d9023e2", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "include/linux/hid.h" }, "signature_type": "Line" }, { "digest": { "length": 1264.0, "function_hash": "86180056594490316600717451057640403042" }, "id": "ASB-A-162844689-7c6d861c", "source": "https://android.googlesource.com/kernel/common/+/bce1305c0ece", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-core.c", "truncated_path_level": 1.0, "function": "hid_report_raw_event" }, "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "299068255504802649116209040212675937216", "53457341015785259956944773031305487166", "246609040952297212995576005721864294505", "71143485541089874782813883057950678646" ] }, "id": "ASB-A-162844689-9aef5c44", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-multitouch.c" }, "signature_type": "Line" }, { "digest": { "length": 229.0, "function_hash": "43365902184106154324947773377471901828" }, "id": "ASB-A-162844689-a0436760", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "include/linux/hid.h", "function": "hid_map_usage_clear" }, "signature_type": "Function" }, { "digest": { "length": 4011.0, "function_hash": "246733631214853289331202726487097603349" }, "id": "ASB-A-162844689-d123162c", "source": "https://android.googlesource.com/kernel/common/+/35556bed836f", "deprecated": false, "signature_version": "v1", "target": { "file": "drivers/hid/hid-multitouch.c", "function": "mt_touch_input_mapping" }, "signature_type": "Function" } ], "fixes": [ "https://android.googlesource.com/kernel/common/+/35556bed836f", "https://android.googlesource.com/kernel/common/+/bce1305c0ece" ], "spl": "2020-12-05", "severity": "High", "types": [ "EoP" ] }