In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Fix a null-ptr-deref bug in bufferprepare() and bufferfinish()
When the driver calls cx23885riscbuffer() to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885riscbuffer() and the value of risc->cpu before buffer free.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89",
"deprecated": false,
"id": "CVE-2023-53458-004d354f",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"36837014071476188265492365123822887882",
"192205286105346315633544626897273097499",
"274147465852719504836795397501207402973",
"322127831937104825704542309854525975151",
"188770583609378045781371240819139662675",
"122459855643367012588634341925637060710",
"269278835952117136329579831013793111163",
"69585035866367855909716958696237163163",
"269827007499896448698874896419053974098",
"300095304174692215377836949685001419562",
"50615157363417912239465175079189817976",
"209750803989174295740447105012014826510",
"34663721232646921876902289788656640253",
"126908152670353824486268350638037952834",
"192967101060447095411540300724681301444",
"142524536747931258340736187369969869477",
"54345580791670082962125927969811297509",
"170453431675046463044531272571234056407",
"189214032296519521703915458409380846645",
"34537815367710682697895207485951025487",
"254764599541815049234409217627098433658",
"108130790816739613665299462183433415348",
"336084678629775618112236576553406922816",
"208333472269777182697594259831082163290",
"277201810466962706652625822484397121514",
"149945912474237222071407248688434254545",
"79100489017165582330436846290194427061",
"317830077990031969868366981143475471326",
"135375354710215340861448296171454965415",
"315001334841720570884941431941035501821",
"186960515976669424991141229296562974255",
"47479164954441213558063190031844484042",
"157691611971073985573150076373122507930",
"194383112865836704323343105931540739094",
"71500152253310843065267796556867152959"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89",
"deprecated": false,
"id": "CVE-2023-53458-1d8c022e",
"target": {
"function": "buffer_prepare",
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"length": 1851.0,
"function_hash": "260211547535728180645598422318110128758"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996",
"deprecated": false,
"id": "CVE-2023-53458-1deebd13",
"target": {
"function": "buffer_prepare",
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"length": 1851.0,
"function_hash": "260211547535728180645598422318110128758"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996",
"deprecated": false,
"id": "CVE-2023-53458-4a9d5924",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"221859127599352550299146787217065886198",
"90426891992356106170344707910167186908",
"208806630488116241976608072505926574997",
"87549769964915013637772661697313186082"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578",
"deprecated": false,
"id": "CVE-2023-53458-84d58221",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"221859127599352550299146787217065886198",
"90426891992356106170344707910167186908",
"208806630488116241976608072505926574997",
"87549769964915013637772661697313186082"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996",
"deprecated": false,
"id": "CVE-2023-53458-9690a632",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"36837014071476188265492365123822887882",
"192205286105346315633544626897273097499",
"274147465852719504836795397501207402973",
"322127831937104825704542309854525975151",
"188770583609378045781371240819139662675",
"122459855643367012588634341925637060710",
"269278835952117136329579831013793111163",
"69585035866367855909716958696237163163",
"269827007499896448698874896419053974098",
"300095304174692215377836949685001419562",
"50615157363417912239465175079189817976",
"209750803989174295740447105012014826510",
"34663721232646921876902289788656640253",
"126908152670353824486268350638037952834",
"192967101060447095411540300724681301444",
"142524536747931258340736187369969869477",
"54345580791670082962125927969811297509",
"170453431675046463044531272571234056407",
"189214032296519521703915458409380846645",
"34537815367710682697895207485951025487",
"254764599541815049234409217627098433658",
"108130790816739613665299462183433415348",
"336084678629775618112236576553406922816",
"208333472269777182697594259831082163290",
"277201810466962706652625822484397121514",
"149945912474237222071407248688434254545",
"79100489017165582330436846290194427061",
"317830077990031969868366981143475471326",
"135375354710215340861448296171454965415",
"315001334841720570884941431941035501821",
"186960515976669424991141229296562974255",
"47479164954441213558063190031844484042",
"157691611971073985573150076373122507930",
"194383112865836704323343105931540739094",
"71500152253310843065267796556867152959"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996",
"deprecated": false,
"id": "CVE-2023-53458-a2287f0f",
"target": {
"function": "cx23885_free_buffer",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"length": 162.0,
"function_hash": "96601194521800383438159165008091229034"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578",
"deprecated": false,
"id": "CVE-2023-53458-a2af2065",
"target": {
"function": "buffer_prepare",
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"length": 1851.0,
"function_hash": "260211547535728180645598422318110128758"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578",
"deprecated": false,
"id": "CVE-2023-53458-be9538e0",
"target": {
"function": "cx23885_free_buffer",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"length": 162.0,
"function_hash": "96601194521800383438159165008091229034"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89",
"deprecated": false,
"id": "CVE-2023-53458-ca7ff674",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"221859127599352550299146787217065886198",
"90426891992356106170344707910167186908",
"208806630488116241976608072505926574997",
"87549769964915013637772661697313186082"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89",
"deprecated": false,
"id": "CVE-2023-53458-cca1d344",
"target": {
"function": "cx23885_free_buffer",
"file": "drivers/media/pci/cx23885/cx23885-core.c"
},
"digest": {
"length": 162.0,
"function_hash": "96601194521800383438159165008091229034"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578",
"deprecated": false,
"id": "CVE-2023-53458-e9c15cba",
"target": {
"file": "drivers/media/pci/cx23885/cx23885-video.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"36837014071476188265492365123822887882",
"192205286105346315633544626897273097499",
"274147465852719504836795397501207402973",
"322127831937104825704542309854525975151",
"188770583609378045781371240819139662675",
"122459855643367012588634341925637060710",
"269278835952117136329579831013793111163",
"69585035866367855909716958696237163163",
"269827007499896448698874896419053974098",
"300095304174692215377836949685001419562",
"50615157363417912239465175079189817976",
"209750803989174295740447105012014826510",
"34663721232646921876902289788656640253",
"126908152670353824486268350638037952834",
"192967101060447095411540300724681301444",
"142524536747931258340736187369969869477",
"54345580791670082962125927969811297509",
"170453431675046463044531272571234056407",
"189214032296519521703915458409380846645",
"34537815367710682697895207485951025487",
"254764599541815049234409217627098433658",
"108130790816739613665299462183433415348",
"336084678629775618112236576553406922816",
"208333472269777182697594259831082163290",
"277201810466962706652625822484397121514",
"149945912474237222071407248688434254545",
"79100489017165582330436846290194427061",
"317830077990031969868366981143475471326",
"135375354710215340861448296171454965415",
"315001334841720570884941431941035501821",
"186960515976669424991141229296562974255",
"47479164954441213558063190031844484042",
"157691611971073985573150076373122507930",
"194383112865836704323343105931540739094",
"71500152253310843065267796556867152959"
]
},
"signature_type": "Line"
}
]