In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccore_init
Syzbot reported that -1 is used as array index. The problem was in missing validation check.
hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.
hdw->workpoll initialization moved upper to prevent warning in _flushwork.
[
{
"id": "CVE-2022-49478-02370bf7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3309c2c574e13b21b44729f5bdbf21f60189b79a",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-197cc2f7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4351bfe36aba9fa7dc9d68d498d25d41a0f45e67",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-1fff5390",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1310fc3538dcc375a2f46ef0a438512c2ca32827",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-2a5c6992",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24e807541e4a9263ed928e6ae3498de3ad43bd1e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-2d2a94ba",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1310fc3538dcc375a2f46ef0a438512c2ca32827",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-4548e7b6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3304766d9384886e6d3092c776273526947a2e9",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-599a19c5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e004fe914b243db41fa96f9e583385f360ea58e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-5a350687",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3309c2c574e13b21b44729f5bdbf21f60189b79a",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-5eb8aa27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99a8b1ec0eddc2931aeaa4f490277a15b39f511",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-614863f2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e004fe914b243db41fa96f9e583385f360ea58e",
"signature_version": "v1",
"digest": {
"length": 8573.0,
"function_hash": "260804650437690181532376841288185603153"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-7671dccd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3660e06675bccec4bf149c7229ea1d491ba10d7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-7a5066f1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@471bec68457aaf981add77b4f590d65dd7da1059",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-bf66339b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@24e807541e4a9263ed928e6ae3498de3ad43bd1e",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-cc404052",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@471bec68457aaf981add77b4f590d65dd7da1059",
"signature_version": "v1",
"digest": {
"length": 8440.0,
"function_hash": "181413250564780192915153147929882286899"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-d92b6545",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99a8b1ec0eddc2931aeaa4f490277a15b39f511",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49478-e393f934",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3660e06675bccec4bf149c7229ea1d491ba10d7",
"signature_version": "v1",
"digest": {
"length": 8487.0,
"function_hash": "258946759008374315633739111503139012831"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-edd5e838",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4351bfe36aba9fa7dc9d68d498d25d41a0f45e67",
"signature_version": "v1",
"digest": {
"length": 8631.0,
"function_hash": "6976010652847814582630601998702922829"
},
"target": {
"function": "pvr2_hdw_create",
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49478-ee9141e6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3304766d9384886e6d3092c776273526947a2e9",
"signature_version": "v1",
"digest": {
"line_hashes": [
"91376960639083941449617560605077394598",
"304843019062439813918480844889437252431",
"71858513000043281181822831045956493519",
"287659967436506369352670566074119442082",
"86557332808352176034085110463316488301",
"339621908162191433930391839873389382152",
"162608187158444864084589835233320773764"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
},
"signature_type": "Line",
"deprecated": false
}
]