In the Linux kernel, the following vulnerability has been resolved:
media: bttv: fix use after free error due to btv->timeout timer
There may be some a race condition between timer function bttvirqtimeout and bttvremove. The timer is setup in probe and there is no timerdelete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug.
This bug is found by static analysis, it may be false positive.
Fix it by adding deltimersync invoking to the remove function.
cpu0 cpu1 bttvprobe ->timersetup ->bttvsetdma ->modtimer; bttvremove ->kfree(btv); ->bttvirqtimeout ->USE btv
[
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-089f90b6",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3d9198cdae1cb079ec8652f4defacd481eab2b"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-08c7e654",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847599fffa528b2cdec4e21b6bf7586dad982132"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-0d198ef1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-1d909a7b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51c94256a83fe4e17406c66ff3e1ad7d242d8574"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-35507f5a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847599fffa528b2cdec4e21b6bf7586dad982132"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-3be66fa8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51c94256a83fe4e17406c66ff3e1ad7d242d8574"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-5a660982",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3d9198cdae1cb079ec8652f4defacd481eab2b"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-5cdd82e7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35fdade92c5058a5e727e233fe263b828de2c9a"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-73f2c50d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd5b50b329e850d467e7bcc07b2b6bde3752fbda"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-7aba8b87",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1871014d6ef4812ad11ef7d838d73ce09d632267"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-8829263c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1871014d6ef4812ad11ef7d838d73ce09d632267"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-9abb213e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35fdade92c5058a5e727e233fe263b828de2c9a"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-a88b25d8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20568d06f6069cb835e05eed432edf962645d226"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-bc5de365",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "290764979195323230470533169316485795845",
"length": 958.0
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c",
"function": "bttv_remove"
},
"signature_version": "v1",
"id": "CVE-2023-52847-c1f7a0d2",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd5b50b329e850d467e7bcc07b2b6bde3752fbda"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218426317471302794733465122414542257739",
"14177672615694424990617028854759783844",
"295132003330078393746750022620118169511",
"176440862666338128757484794246774317175"
]
},
"target": {
"file": "drivers/media/pci/bt8xx/bttv-driver.c"
},
"signature_version": "v1",
"id": "CVE-2023-52847-eedcb706",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20568d06f6069cb835e05eed432edf962645d226"
}
]