In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix use after free on context disconnection
Upon module load, a kthread is created targeting the pvr2contextthreadfunc function, which may call pvr2contextdestroy and thus call kfree() on the context object. However, that might happen before the usb hubevent handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
{
"vanir_signatures": [
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-5d50772b"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-7c8c9f49"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-806c949f"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-972c3db8"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-9bfd2e93"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-a4321ea5"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-a476944c"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-a4fd9eb9"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-bd0f9366"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-bded5db2"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-cf8ffe55"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-d81e9191"
},
{
"signature_version": "v1",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1",
"deprecated": false,
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"id": "CVE-2023-52445-da067da7"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-e67c37d5"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-f8e41997"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e",
"deprecated": false,
"digest": {
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
],
"threshold": 0.9
},
"id": "CVE-2023-52445-fabba72a"
}
]
}