CVE-2022-48978

A flaw was found in the Linux kernel's Human Interface Device (HID) core. A local attacker with low privileges could exploit a shift-out-of-bounds vulnerability in the hid_report_raw_event function. This occurs when the size of an integer in the snto32() function exceeds 32 bits, leading to an invalid shift operation. Successful exploitation of this vulnerability could result in a system crash, causing a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation, blacklist the hid kernel module. Create /etc/modprobe.d/disable-hid.conf with install hid /bin/true. Regenerate the initramfs and reboot the system. Note that disabling the hid module will prevent the use of Human Interface Devices, such as keyboards and mice, impacting system usability.