CVE-2024-56629

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

HID: wacom: fix when get product name maybe null pointer

Due to incorrect dev->product reporting by certain devices, null

pointer dereferences occur when dev->product is empty, leading to

potential system crashes.

This issue was found on EXCELSIOR DL37-D05 device with

Loongson-LS3A6000-7A2000-DL37 motherboard.

Kernel logs:

[ 56.470885] usb 4-3: new full-speed USB device number 4 using ohci-pci

[ 56.671638] usb 4-3: string descriptor 0 read error: -22

[ 56.671644] usb 4-3: New USB device found, idVendor=056a, idProduct=0374, bcdDevice= 1.07

[ 56.671647] usb 4-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3

[ 56.678839] hid-generic 0003:056A:0374.0004: hiddev0,hidraw3: USB HID v1.10 Device [HID 056a:0374] on usb-0000:00:05.0-3/input0

[ 56.697719] CPU 2 Unable to handle kernel paging request at virtual address 0000000000000000, era == 90000000066e35c8, ra == ffff800004f98a80

[ 56.697732] Oops

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References