CVE-2022-20132

What it actually does

Out-of-bounds read in USB HID probe functions due to missing input validation, exposing kernel memory contents to a local attacker with physical device access.

Why it matters to the business

Attackers with brief physical access can extract sensitive data from affected systems; the issue appears in widely used kernel code with many downstream dependents, increasing exposure surface across Android-based devices and related open-source projects.

How an attack unfolds

An attacker prepares a malicious USB HID device that supplies crafted descriptors; upon insertion the kernel's lg_probe and related HID parsing paths perform an unchecked read, disclosing memory without user interaction or privileges.

How to fix it

Update usememos/memos (GIT) to commit 3556ae4e651d9443dc3bb8a170dd3cc726517a53 or later; apply the corresponding upstream kernel patch that adds proper bounds checks in hid-lg.c and related files.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel tree; attempt to trigger the original descriptor path with a test device and verify no out-of-bounds access occurs in logs or via KASAN.

Typical attack path

1. Craft a USB HID device with malformed report descriptors
2. Gain brief physical access to the target system
3. Insert the device to trigger USB enumeration
4. Read disclosed kernel memory contents from the resulting oops or side-channel

How to detect it

Review kernel logs for USB HID enumeration events followed by out-of-bounds read warnings or crashes; examine dmesg and audit logs for unexpected device insertions around the time of suspected data leakage.

What your security team should do

• Prioritize patching systems that accept arbitrary USB devices
• Apply the exact fixed commit 3556ae4e651d9443dc3bb8a170dd3cc726517a53 across all affected repositories
• Disable unnecessary USB HID support where physical access cannot be controlled
• Monitor vendor advisories for backported fixes in Android kernels