In the Linux kernel, the following vulnerability has been resolved:
media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035i2cmaster_xfer
In af9035i2cmasterxfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035i2cmasterxfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()")
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52915.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52915.json"
[
{
"id": "CVE-2023-52915-31693da7",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa58d9db5cad4bb7bb694b6837e3b96d87554f2b",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52915-32f8c80e",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49c6e5dd236787f13a062ec528d724169f11152",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52915-5fd9fd21",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b7181a40af84448a2b144fb02d8bf32b7e9a23",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-7bf82053",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0143f282b15f7cedc0392ea10050fb6000fd16e6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120292450682070554734253689757648296112",
"203436536528310634714352588834951781740",
"279319831917557576711536716675929602486",
"74845627980906047178947358744771533391",
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-91bc6e2e",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c01ef65de0b321b2db1ef9abf8f1d15862b937e",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52915-9a02e6d2",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41b7181a40af84448a2b144fb02d8bf32b7e9a23",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52915-a474bf0b",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2f54ed7739dfdf42c4df0a11131aad7c8635464",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120292450682070554734253689757648296112",
"203436536528310634714352588834951781740",
"279319831917557576711536716675929602486",
"74845627980906047178947358744771533391",
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-a995a1a8",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fa58d9db5cad4bb7bb694b6837e3b96d87554f2b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120292450682070554734253689757648296112",
"203436536528310634714352588834951781740",
"279319831917557576711536716675929602486",
"74845627980906047178947358744771533391",
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-b2720aa7",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0143f282b15f7cedc0392ea10050fb6000fd16e6",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-52915-c27fb876",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c01ef65de0b321b2db1ef9abf8f1d15862b937e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120292450682070554734253689757648296112",
"203436536528310634714352588834951781740",
"279319831917557576711536716675929602486",
"74845627980906047178947358744771533391",
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-e67c1102",
"target": {
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49c6e5dd236787f13a062ec528d724169f11152",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120292450682070554734253689757648296112",
"203436536528310634714352588834951781740",
"279319831917557576711536716675929602486",
"74845627980906047178947358744771533391",
"310511723751172447782631631244594200586",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"169656656434102133510899487521823934199",
"147652033639205753078278400406912496157",
"62256400276630692382844895426222942165",
"129813973866144963309179755952773023627",
"288824357498693940690606728133909317852",
"130127739619859713110253414205110681374",
"185039615393822110649817349523536226846",
"105716409537088843527367443335257058611",
"158730438595365084722726850353645217301",
"238309087089785018480075008298611411716",
"227094545905674756426055245570423719367",
"287573390453021051945322558936710095604"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-52915-e992f747",
"target": {
"function": "af9035_i2c_master_xfer",
"file": "drivers/media/usb/dvb-usb-v2/af9035.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2f54ed7739dfdf42c4df0a11131aad7c8635464",
"digest": {
"function_hash": "178350840571760342309304822191315789254",
"length": 4036.0
},
"signature_type": "Function"
}
]