CVE-2024-39509

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: core: remove unnecessary WARN_ON() in implement()

Syzkaller hit a warning [1] in a call to implement() when trying

to write a value into a field of smaller size in an output report.

Since implement() already has a warn message printed out with the

help of hid_warn() and value in question gets trimmed with:

...

value &= m;

...

WARN_ON may be considered superfluous. Remove it to suppress future

syzkaller triggers.

[1]

WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 implement drivers/hid/hid-core.c:1451 [inline]

WARNING: CPU: 0 PID: 5084 at drivers/hid/hid-core.c:1451 hid_output_report+0x548/0x760 drivers/hid/hid-core.c:1863

Modules linked in:

CPU: 0 PID: 5084 Comm: syz-executor424 Not tainted 6.9.0-rc7-syzkaller-00183-gcf87f46fd34d #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024

RIP: 0010:implement drivers/hid/hid-core.c:1451 [inline]

RIP: 0010:hid_output_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References