CVE-2024-46747

What it actually does

The cougar_report_fixup function in the Linux kernel HID driver performs a slab-out-of-bounds read because it accesses the report descriptor without first validating its size for the Cougar 500k Gaming Keyboard.

Why it matters to the business

Systems using affected Cougar keyboards may experience kernel crashes, memory corruption, or information disclosure, leading to downtime and potential data exposure on Linux-based devices or servers.

How an attack unfolds

An attacker connects a malicious or malformed Cougar 500k Gaming Keyboard (or emulated HID device) to a vulnerable Linux system; the kernel invokes cougar_report_fixup during report parsing, triggering the out-of-bounds read before any size check occurs.

How to fix it

Update the Linux kernel to the fixed commit e239e44dcd419b13cf840e2a3a833204e4329714 or later stable releases containing the patch; rebuild and deploy the updated kernel image on affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e239e44dcd419b13cf840e2a3a833204e4329714 via git log or uname; test with a Cougar 500k device to verify no out-of-bounds access occurs during report fixup.

Typical attack path

1. Attacker obtains or emulates a Cougar 500k Gaming Keyboard with a crafted report descriptor
2. Target system loads the HID driver and calls cougar_report_fixup on device connection
3. Missing size validation allows out-of-bounds memory read in the slab allocator
4. Attacker observes crash, leaks, or uses the corruption for further kernel exploitation

How to detect it

Review kernel logs for HID driver errors or slab-out-of-bounds warnings during device enumeration; inspect dmesg output and audit logs for unexpected Cougar keyboard report descriptor activity.

What your security team should do

• Prioritize kernel updates on all Linux endpoints and servers that may encounter Cougar HID devices
• Monitor kernel logs for slab allocation warnings or crashes related to HID report parsing
• Apply the fix in the next maintenance window given the memory corruption impact