CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's synaptics-rmi4 driver, where improper handling of error conditions can lead to a heap buffer overflow due to stale payload sizes being copied into smaller buffers. This flaw can be exploited if a user modifies the V4L2 format, potentially allowing for arbitrary code execution or system crashes. Organizations using affected Linux distributions or F5 products should prioritize patching this vulnerability to mitigate risks associated with buffer overflow attacks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful payload size. If a user then altered the V4L2 format to a smaller size, and a subsequent run failed, rmi_f54_buffer_queue() would copy the stale, larger payload size into the shrunken V4L2 buffer, causing a heap buffer overflow. Fix this by merging the 'abort' and 'error' labels into a single 'out' exit path, and ensuring that f54->report_size is always set to 0 on failure by checking for error and zeroing the local report_size first.