CVE-2024-46747

A flaw was found in the Linux kernel's HID (Human Interface Device) subsystem, specifically within the driver for the Cougar 500k Gaming Keyboard. The report_fixup function failed to validate the size of the report descriptor before processing it. This oversight could allow a local attacker to trigger a slab-out-of-bounds read, potentially leading to information disclosure or a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the hid-cougar kernel module from loading by blacklisting it. Create a file named /etc/modprobe.d/blacklist-hid-cougar.conf with the following content:

blacklist hid-cougar

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact the functionality of Cougar 500k Gaming Keyboards if they are in use.