# Re: \[PATCH 0/2\] HID: hyperv: bound initial device info descriptor

- From: Jiri Kosina \<jikos@kernel.org\>
- Date: 2026-08-03 19:10:29 
- List: linux-input
- Page: https://ratatoskr.run/linux-input/2026/08/17359721
- Thread: https://ratatoskr.run/linux-input/2026/07/17239644/t.md

```text
On Thu, 9 Jul 2026, Michael Bommarito wrote:

> A malicious Hyper-V host or backend can crash a guest with a short
> SYNTH_HID_INITIAL_DEVICE_INFO message. mousevsc_on_receive_device_info()
> trusts the HID descriptor bLength and wDescriptorLength without checking
> that the received VMBus packet actually contains both byte ranges, so a
> truncated packet with an oversized report-descriptor length makes the
> guest read past the received packet while copying the descriptor. This
> matters most for a confidential guest, where the host is outside the trust
> boundary.

Well, untrusted host can crash the (confidential) guest in various other 
ways.

Anyway, the sanitization is good, so I've now applied it.

Thanks,

-- 
Jiri Kosina
SUSE Labs

```