Attack Chain

1. Attacker ensures the process has write permissions to /dev/uhid (e.g., membership in uhid group).
2. Attacker initializes a virtual HID device via uhid.
3. Attacker submits a maliciously crafted HID descriptor containing HID_DG_PEN, HID_DG_STYLUS, and HID_DG_TOOLSERIALNUMBER usages.
4. Attacker uses 2-byte usage items (0x1A/0x2A) to avoid truncation and trigger the OOB read loop.
5. The wacom driver binds to the virtual device and processes the descriptor.
6. The wacom_wac_pen_serial_enforce() function accesses memory out-of-bounds due to an improper loop limit based on field->maxusage.
7. Leaked kernel memory values are written to MSC_SERIAL and reported to /dev/input/eventN.
8. Attacker reads the MSC_SERIAL event from the input node to recover kernel pointers.

Impact

Successful exploitation allows an unprivileged local user to bypass KASLR and leak sensitive kernel heap pointers. While the current PoC lacks a write primitive, these leaks are critical prerequisites for more complex kernel exploitation chains.

Recommendation

• Patch the kernel immediately using upstream commit 9aa237cf6649 or stable branch fix eaa7d29341ef.
• Audit system configurations for access to /dev/uhid. Restrict write access to this device node to only necessary and trusted service accounts to prevent local users from creating virtual HID devices.
• Implement monitoring for processes that interact with /dev/uhid and subsequently monitor /dev/input/event* nodes if those processes are not trusted HID services.