In the Linux kernel, the following vulnerability has been resolved:
media: pci: cx23885: Fix the error handling in cx23885_initdev()
When the driver fails to call the dmasetmask(), the driver will get the following splat:
[ 55.853884] BUG: KASAN: use-after-free in _processremoveddriver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 [ 55.856822] Call Trace: [ 55.860327] _processremoveddriver+0x3c/0x240 [ 55.861347] busforeachdev+0x102/0x160 [ 55.861681] i2cdel_driver+0x2f/0x50
This is because the driver has initialized the i2c related resources in cx23885devsetup() but not released them in error handling, fix this bug by modifying the error path that jumps after failing to call the dmasetmask().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86bd6a579c6c60547706cabf299cd2c9feab3332",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-02f11733",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333327950365161302353458761145777306940",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98106f100f50c487469903b9cf6d966785fc9cc3",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-20fd37d5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333327950365161302353458761145777306940",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca17e7a532d1a55466cc007b3f4d319541a27493",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-309e85e5",
"digest": {
"length": 1697.0,
"function_hash": "31775454844707236965390125666273008074"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@453514a874c78df1e7804e6e3aaa60c8d8deb6a8",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-3a580d37",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333327950365161302353458761145777306940",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca17e7a532d1a55466cc007b3f4d319541a27493",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-58fee3b5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"81369900461292283082074168295326527200",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86bd6a579c6c60547706cabf299cd2c9feab3332",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-5e4a1b2f",
"digest": {
"length": 1706.0,
"function_hash": "238862567630658919761966335646678111127"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa636e9ee4442215cd9a2e079cd5a8e1fe0cb8ba",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-61f09f2e",
"digest": {
"length": 1697.0,
"function_hash": "31775454844707236965390125666273008074"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b9978e1c94e569d65a0e7e719abb9340f5db4a0",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-6a5bd2a1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"81369900461292283082074168295326527200",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6041d1a0365baa729b6adfb6ed5386d9388018db",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-78ced3b8",
"digest": {
"length": 1658.0,
"function_hash": "27038897751490370766227060785630567789"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b9978e1c94e569d65a0e7e719abb9340f5db4a0",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-7da0ab90",
"digest": {
"length": 1697.0,
"function_hash": "31775454844707236965390125666273008074"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa636e9ee4442215cd9a2e079cd5a8e1fe0cb8ba",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-949ec962",
"digest": {
"threshold": 0.9,
"line_hashes": [
"81369900461292283082074168295326527200",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@453514a874c78df1e7804e6e3aaa60c8d8deb6a8",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-95a5100b",
"digest": {
"length": 1706.0,
"function_hash": "238862567630658919761966335646678111127"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8123311cf06d7dae71e8c5fe78e0510d20cd30b",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-98d87da6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333327950365161302353458761145777306940",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@98106f100f50c487469903b9cf6d966785fc9cc3",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-9eb0e367",
"digest": {
"length": 1706.0,
"function_hash": "238862567630658919761966335646678111127"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6041d1a0365baa729b6adfb6ed5386d9388018db",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-adc9c162",
"digest": {
"threshold": 0.9,
"line_hashes": [
"81369900461292283082074168295326527200",
"59152228756175749678139223162798685332",
"198958619409541559971323565283483265096",
"147042491230986189162867883449968405696",
"14683125689478699789066591345690569805",
"75110459778239403037431285562924073096",
"97873972358936595813805928703137621899",
"255596551246144064574566899015355256418",
"235112863214186578874958947661302972937",
"63811056772453307528569049095154332723",
"237740020474516478986869746402709207479",
"48073911198396552772885301566016182742"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8123311cf06d7dae71e8c5fe78e0510d20cd30b",
"target": {
"function": "cx23885_initdev",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49524-e11c1df2",
"digest": {
"length": 1706.0,
"function_hash": "238862567630658919761966335646678111127"
},
"signature_type": "Function"
}
]