291 lines
15 KiB
JSON
291 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53797",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-08T23:58:35.275Z",
|
|
"datePublished": "2025-12-09T00:00:53.868Z",
|
|
"dateUpdated": "2026-08-05T09:16:04.053Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:16:04.053Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: Use ktime_t rather than int when dealing with timestamps\n\nCode which interacts with timestamps needs to use the ktime_t type\nreturned by functions like ktime_get. The int type does not offer\nenough space to store these values, and attempting to use it is a\nrecipe for problems. In this particular case, overflows would occur\nwhen calculating/storing timestamps leading to incorrect values being\nreported to userspace. In some cases these bad timestamps cause input\nhandling in userspace to appear hung."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:A - The vulnerable parser is reached only through HID reports from a Bluetooth-attached Wacom tablet — all affected device IDs (0x360, 0x361, 0x393, 0x377, 0x379) are registered with BT_DEVICE_WACOM/BUS_BLUETOOTH, so the attack surface is the Bluetooth peer within radio range. This matches the Adjacent classification used for other wacom BT report-handler CVEs.\nAC:L - The truncation is unconditional and deterministic — a signed int holds only ~2.1 seconds of nanoseconds, so ktime_get() values stored in time_delayed wrap within seconds of uptime on every affected device with no attacker-uncontrollable preconditions.\nPR:N - No credentials or privileges on the target system are needed; the malformed state is produced from data supplied by the Bluetooth HID peer, and wacom_raw_event()/wacom_wac_irq() perform no capability or permission checks before dispatching to wacom_intuos_pro2_bt_pen().\nUI:N - The overflow occurs during ordinary pen-report processing on a connected tablet with no victim action required beyond normal device use.\nS:U - The corrupted timestamps stay within the kernel input subsystem and the evdev consumers of the same system; no security authority or isolation boundary is crossed.\nC:N - The bad values are derived solely from truncated monotonic clock readings, which userspace can already obtain via clock_gettime(); no kernel memory contents, pointers, or heap data are disclosed.\nI:L - The kernel writes incorrect event timestamps into the input event stream delivered to userspace, so applications consume corrupted data; the modification is real but bounded to the timestamp fields of input events.\nA:H - The commit states the bad timestamps cause input handling in userspace to appear hung, i.e. a complete loss of availability of the affected input device — on graphics workstations, kiosks, and embedded panels where the digitizer is the primary or sole input device this is a total denial of interactive service requiring intervention to recover."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/hid/wacom_wac.c",
|
|
"drivers/hid/wacom_wac.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "f9e27d4bdb1fe257c1453d02560e3adc3e5b6023",
|
|
"lessThan": "99036f1aed7e82773904f5d91a9897bb3e507fd9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4502ebbdc0e21e44a8a706428e420ae9c1bb9bba",
|
|
"lessThan": "9598a647ecc8f300b0540abf9d3b3439859d163b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5047a228d4c8e2b5d1b856f21a00ecf717945a9c",
|
|
"lessThan": "67ce7724637c6adb66f788677cb50b82615de0ac",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "fb98336e23c11e9c8c7dd5425ec71adbbef7f773",
|
|
"lessThan": "d89750b19681581796dfbe3689bbb5d439b99b24",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "694d3e4387bfa69925e075053894385351106e64",
|
|
"lessThan": "bdeaa883b765709f231f47f9d6cc76c837a15396",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "17d793f3ed53080dab6bbeabfc82de890c901001",
|
|
"lessThan": "d0198363f9108e4adb2511e607ba91e44779e8b1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "17d793f3ed53080dab6bbeabfc82de890c901001",
|
|
"lessThan": "9a6c0e28e215535b2938c61ded54603b4e5814c5",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "82a136c35506dc788a6c03ffeb11b10c907b0e26",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5.4.243",
|
|
"lessThan": "5.4.251",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.180",
|
|
"lessThan": "5.10.188",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.112",
|
|
"lessThan": "5.15.120",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.29",
|
|
"lessThan": "6.1.37",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.3",
|
|
"lessThan": "6.3.11",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2.16",
|
|
"lessThan": "6.3",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/hid/wacom_wac.c",
|
|
"drivers/hid/wacom_wac.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.4",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.4",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.251",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.188",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.120",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.37",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.11",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4.1",
|
|
"lessThanOrEqual": "6.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.5",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.4.243",
|
|
"versionEndExcluding": "5.4.251"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10.180",
|
|
"versionEndExcluding": "5.10.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15.112",
|
|
"versionEndExcluding": "5.15.120"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.1.29",
|
|
"versionEndExcluding": "6.1.37"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.3.3",
|
|
"versionEndExcluding": "6.3.11"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4",
|
|
"versionEndExcluding": "6.4.1"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.4",
|
|
"versionEndExcluding": "6.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2.16"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/99036f1aed7e82773904f5d91a9897bb3e507fd9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9598a647ecc8f300b0540abf9d3b3439859d163b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/67ce7724637c6adb66f788677cb50b82615de0ac"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d89750b19681581796dfbe3689bbb5d439b99b24"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bdeaa883b765709f231f47f9d6cc76c837a15396"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d0198363f9108e4adb2511e607ba91e44779e8b1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9a6c0e28e215535b2938c61ded54603b4e5814c5"
|
|
}
|
|
],
|
|
"title": "HID: wacom: Use ktime_t rather than int when dealing with timestamps",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |