Linux hid-logitech-hidpp driver hidpp_ff_init memory leak vulnerability analysis

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Type: Memory Leak Affected Driver: (Logitech HID++ device driver) Vulnerability Description: In the function, if subsequent allocations (such as allocations after succeeds) fail, the function returns an error, but the previously allocated private data (HID++ FF private data, effect ID array, workqueue) is not released, resulting in a memory leak. Scope of Impact Affected Files: - - Affected Function: Trigger Condition: succeeds, but subsequent allocations (such as , , etc.) fail, and is not called for cleanup. Remediation Plan Fix Commit: Fix Details: - In , if subsequent allocations fail, call to release allocated resources. - Added a new function, which is responsible for releasing resources such as , , and . - Added an error handling path in to ensure proper cleanup whenever any allocation fails. POC / Exploitation Code ```c // Key code snippet after the fix (from diff) static int hidpp_ff_init(struct hidpp_device *hidpp, version); { data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hidpp; data->kernel_hid = hid

Goal Reached Thanks to every supporter — we hit 100%!

Linux hid-logitech-hidpp driver hidpp_ff_init memory leak vulnerability analysis