CVE-2021-47404

What it actually does

Slab-out-of-bounds write in the hid-betopff driver caused by missing validation that an input report exists before use, allowing a malicious HID device to trigger memory corruption during probe.

Why it matters to the business

Systems accepting untrusted USB HID devices face risk of kernel-level memory corruption that can lead to crashes, denial of service, or potential privilege escalation, affecting device compatibility and requiring kernel updates across fleets.

How an attack unfolds

An attacker presents a crafted USB HID device lacking an input report to a system loading the betop driver; the probe function dereferences an empty input list, writing beyond slab bounds and corrupting kernel memory.

How to fix it

Update the Linux kernel to a version containing the fix that adds a check for non-empty hid_device input before use in the betop driver; rebuild and deploy the patched kernel image across affected systems.

How to confirm the fix worked

Confirm the updated kernel source contains the input report emptiness check in betop_probe; test with a device simulator that omits the input report and verify no slab-out-of-bounds write occurs in logs or with memory debugging tools.

Typical attack path

1. Connect malicious USB HID device to target system
2. Kernel loads hid-betopff driver for the device
3. betop_probe assumes non-empty input report and performs unchecked write
4. Memory corruption occurs in kernel slab allocator
5. Attacker leverages corruption for crash or code execution

How to detect it

Review kernel logs and dmesg output for slab allocation errors or warnings referencing the betop or hid-betopff driver during USB device enumeration; correlate with unexpected USB device attachment events.

• hid-betopff
• slab-out-of-bounds Write in betop_probe
• betop_probe

What your security team should do

• Prioritize kernel updates on systems that may encounter untrusted USB devices
• Disable the hid-betopff driver module if the hardware is not required
• Monitor kernel logs for hid and slab error messages after changes
• Apply defense-in-depth USB device allow-listing where feasible