In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccore_init
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in _flushwork.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
]
},
"id": "CVE-2022-49478-02370bf7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3309c2c574e13b21b44729f5bdbf21f60189b79a",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"id": "CVE-2022-49478-5a350687",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3309c2c574e13b21b44729f5bdbf21f60189b79a",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c",
"function": "pvr2_hdw_create"
}
}
]