Re: [PATCH v5] HID: rmi: fix OOB access with undersized RMI reports

[Wei Jie LAW]

Impact information for this patch, in case it is useful for prioritising
it. No change to the patch is required.

I have a working local privilege escalation on this bug. An
attacker-controlled USB device plus an unprivileged process on the target
gives root. Both halves are needed -- it is not remote, and not
device-only.

The disclosure half needs is via USB-only. The initial commit 
already explains the vulnerable path.

Reproduced to a root shell on three kernels. All with KASLR, 
SLAB_FREELIST_RANDOM, SLAB_FREELIST_HARDENED, 
INIT_ON_ALLOC_DEFAULT_ON and HARDENED_USERCOPY
on, and no debug options or debug allocator:

  6.12.69+                  own config     RKC=n    root
  v6.12.105                 own config     RKC=n    root
  v6.12.105                 Ubuntu config  RKC=n    root
  Ubuntu 7.0.0-28-generic   stock          RKC=y    disclosure only

RKC is CONFIG_RANDOM_KMALLOC_CACHES, =y on current Ubuntu, n upstream.
The last two rows are a controlled pair: Ubuntu's own config, rebuilt on
v6.12.105 with that one option off and nothing else changed. With it off
the victim object is adjacent on the first plug and the chain completes;
with it on the device saw no usable neighbour in eight plugs. So on
Ubuntu that option is what stops the write. It does not stop the
disclosure -- KASLR still falls there.

Unsure if CONFIG_RANDOM_KMALLOC_CACHES=y will stop the write every
time or only most of the time as per-boot seed is fixed, and I have
only tested a single boot.

The bug still exists in LTS 6.12.y, as well as mainline. The
code dates to 9fb6bf02e3ad, so this reaches every supported tree.

I have not published the PoC and will not before this is merged. 
If it will be useful for review, do let me know and I will send it
privately to any of you who requests.

Thanks,
Wei Jie Law