In the Linux kernel, the following vulnerability has been resolved:
media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
When the driver calls tw68riscbuffer() to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of tw68riscbuffer() and the value of buf->cpu before buffer free.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_prepare" }, "deprecated": false, "digest": { "length": 1181.0, "function_hash": "204175930634691535009008186058247430154" }, "id": "CVE-2023-53244-5c2b9795", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/tw68/tw68-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "132188205382877332009836925136598164914", "111161534794689435439520706534911377549", "114861313067031862716191270218194720500", "227665836887422614251072346752389691099", "41239567458393720150750778419023692476", "78249161416309519640173127067566572929", "155689465068895053915836272907379866537", "324388695856914350101326747745087579486", "182814005822707178938681012531252764157", "291640971209214860396243082187898671311", "233605209835373738808053018058583309210", "197525132036443174943982862547397121643", "179553360840115315538746354393706658894", "2283355302179518166486068921440509077", "288680247218071285166558244312280637140", "286443797207202997640136315022185478467", "306235616323357276077104291020168687259", "27397075645066424747968249058390448025", "160535768802474445616450912628804001979", "7966248555987535729024826639830470978", "249529889376895448739497242877224461369", "36103906346781736888358287666073719277", "304128978298667550215291584411967458819", "89178678970433857132883739515156922147", "296161049296596516743042738724437183898", "5032024513036303789219706273423771159", "190650380079346569050234170439704888578", "60923546997240157410935556652982858797", "98057762726795341531481300557154757250", "31381738606393576356094679395681491079", "231593309624173503960291397641503310697", "12836040449094093204389755484965888794", "176529674803743739964209027301429920610", "111350078613017137867927517271985103181", "11780469891184208814658120500722125676" ], "threshold": 0.9 }, "id": "CVE-2023-53244-6165bd76", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/tw68/tw68-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "132188205382877332009836925136598164914", "111161534794689435439520706534911377549", "114861313067031862716191270218194720500", "227665836887422614251072346752389691099", "41239567458393720150750778419023692476", "78249161416309519640173127067566572929", "155689465068895053915836272907379866537", "324388695856914350101326747745087579486", "182814005822707178938681012531252764157", "291640971209214860396243082187898671311", "233605209835373738808053018058583309210", "197525132036443174943982862547397121643", "179553360840115315538746354393706658894", "2283355302179518166486068921440509077", "288680247218071285166558244312280637140", "286443797207202997640136315022185478467", "306235616323357276077104291020168687259", "27397075645066424747968249058390448025", "160535768802474445616450912628804001979", "7966248555987535729024826639830470978", "249529889376895448739497242877224461369", "36103906346781736888358287666073719277", "304128978298667550215291584411967458819", "89178678970433857132883739515156922147", "296161049296596516743042738724437183898", "5032024513036303789219706273423771159", "190650380079346569050234170439704888578", "60923546997240157410935556652982858797", "98057762726795341531481300557154757250", "31381738606393576356094679395681491079", "231593309624173503960291397641503310697", "12836040449094093204389755484965888794", "176529674803743739964209027301429920610", "111350078613017137867927517271985103181", "11780469891184208814658120500722125676" ], "threshold": 0.9 }, "id": "CVE-2023-53244-6535ddac", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_finish" }, "deprecated": false, "digest": { "length": 294.0, "function_hash": "264724835848455933511112270234305969205" }, "id": "CVE-2023-53244-6ecff2b2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_finish" }, "deprecated": false, "digest": { "length": 294.0, "function_hash": "264724835848455933511112270234305969205" }, "id": "CVE-2023-53244-7fdc6b14", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_prepare" }, "deprecated": false, "digest": { "length": 1181.0, "function_hash": "204175930634691535009008186058247430154" }, "id": "CVE-2023-53244-8ea7f040", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_prepare" }, "deprecated": false, "digest": { "length": 1181.0, "function_hash": "204175930634691535009008186058247430154" }, "id": "CVE-2023-53244-9514146f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/tw68/tw68-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "132188205382877332009836925136598164914", "111161534794689435439520706534911377549", "114861313067031862716191270218194720500", "227665836887422614251072346752389691099", "41239567458393720150750778419023692476", "78249161416309519640173127067566572929", "155689465068895053915836272907379866537", "324388695856914350101326747745087579486", "182814005822707178938681012531252764157", "291640971209214860396243082187898671311", "233605209835373738808053018058583309210", "197525132036443174943982862547397121643", "179553360840115315538746354393706658894", "2283355302179518166486068921440509077", "288680247218071285166558244312280637140", "286443797207202997640136315022185478467", "306235616323357276077104291020168687259", "27397075645066424747968249058390448025", "160535768802474445616450912628804001979", "7966248555987535729024826639830470978", "249529889376895448739497242877224461369", "36103906346781736888358287666073719277", "304128978298667550215291584411967458819", "89178678970433857132883739515156922147", "296161049296596516743042738724437183898", "5032024513036303789219706273423771159", "190650380079346569050234170439704888578", "60923546997240157410935556652982858797", "98057762726795341531481300557154757250", "31381738606393576356094679395681491079", "231593309624173503960291397641503310697", "12836040449094093204389755484965888794", "176529674803743739964209027301429920610", "111350078613017137867927517271985103181", "11780469891184208814658120500722125676" ], "threshold": 0.9 }, "id": "CVE-2023-53244-a8768609", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/tw68/tw68-video.c", "function": "tw68_buf_finish" }, "deprecated": false, "digest": { "length": 294.0, "function_hash": "264724835848455933511112270234305969205" }, "id": "CVE-2023-53244-bcc718cd", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6" } ] }