In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix use after free on context disconnection
Upon module load, a kthread is created targeting the pvr2contextthreadfunc function, which may call pvr2contextdestroy and thus call kfree() on the context object. However, that might happen before the usb hubevent handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-5d50772b",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-7c8c9f49",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-806c949f",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-972c3db8",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-9bfd2e93",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-a4321ea5",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-a476944c",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-a4fd9eb9",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-bd0f9366",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-bded5db2",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-cf8ffe55",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-d81e9191",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-da067da7",
"target": {
"function": "pvr2_context_disconnect",
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"length": 118.0,
"function_hash": "288070376354674802128510423283023829317"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-e67c37d5",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-f8e41997",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-52445-fabba72a",
"target": {
"file": "drivers/media/usb/pvrusb2/pvrusb2-context.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281129451205151595534741710845842485307",
"47368168476949632402305174554640311935",
"107811274798125498735693363506645089598",
"296083914586674035031787357217628684114"
]
},
"signature_type": "Line"
}
]