In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Fix a null-ptr-deref bug in bufferprepare() and bufferfinish()
When the driver calls cx23885riscbuffer() to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885riscbuffer() and the value of risc->cpu before buffer free.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "36837014071476188265492365123822887882", "192205286105346315633544626897273097499", "274147465852719504836795397501207402973", "322127831937104825704542309854525975151", "188770583609378045781371240819139662675", "122459855643367012588634341925637060710", "269278835952117136329579831013793111163", "69585035866367855909716958696237163163", "269827007499896448698874896419053974098", "300095304174692215377836949685001419562", "50615157363417912239465175079189817976", "209750803989174295740447105012014826510", "34663721232646921876902289788656640253", "126908152670353824486268350638037952834", "192967101060447095411540300724681301444", "142524536747931258340736187369969869477", "54345580791670082962125927969811297509", "170453431675046463044531272571234056407", "189214032296519521703915458409380846645", "34537815367710682697895207485951025487", "254764599541815049234409217627098433658", "108130790816739613665299462183433415348", "336084678629775618112236576553406922816", "208333472269777182697594259831082163290", "277201810466962706652625822484397121514", "149945912474237222071407248688434254545", "79100489017165582330436846290194427061", "317830077990031969868366981143475471326", "135375354710215340861448296171454965415", "315001334841720570884941431941035501821", "186960515976669424991141229296562974255", "47479164954441213558063190031844484042", "157691611971073985573150076373122507930", "194383112865836704323343105931540739094", "71500152253310843065267796556867152959" ], "threshold": 0.9 }, "id": "CVE-2023-53458-004d354f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c", "function": "buffer_prepare" }, "deprecated": false, "digest": { "length": 1851.0, "function_hash": "260211547535728180645598422318110128758" }, "id": "CVE-2023-53458-1d8c022e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c", "function": "buffer_prepare" }, "deprecated": false, "digest": { "length": 1851.0, "function_hash": "260211547535728180645598422318110128758" }, "id": "CVE-2023-53458-1deebd13", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c", "function": "buffer_prepare" }, "deprecated": false, "digest": { "length": 1851.0, "function_hash": "260211547535728180645598422318110128758" }, "id": "CVE-2023-53458-27e275d6", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6738841f6fcf23e9fc30e2449f32fc84ee19c6f1" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c" }, "deprecated": false, "digest": { "line_hashes": [ "221859127599352550299146787217065886198", "90426891992356106170344707910167186908", "208806630488116241976608072505926574997", "87549769964915013637772661697313186082" ], "threshold": 0.9 }, "id": "CVE-2023-53458-4a9d5924", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c", "function": "cx23885_free_buffer" }, "deprecated": false, "digest": { "length": 162.0, "function_hash": "96601194521800383438159165008091229034" }, "id": "CVE-2023-53458-60f7f51e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6738841f6fcf23e9fc30e2449f32fc84ee19c6f1" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c" }, "deprecated": false, "digest": { "line_hashes": [ "221859127599352550299146787217065886198", "90426891992356106170344707910167186908", "208806630488116241976608072505926574997", "87549769964915013637772661697313186082" ], "threshold": 0.9 }, "id": "CVE-2023-53458-84d58221", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "36837014071476188265492365123822887882", "192205286105346315633544626897273097499", "274147465852719504836795397501207402973", "322127831937104825704542309854525975151", "188770583609378045781371240819139662675", "122459855643367012588634341925637060710", "269278835952117136329579831013793111163", "69585035866367855909716958696237163163", "269827007499896448698874896419053974098", "300095304174692215377836949685001419562", "50615157363417912239465175079189817976", "209750803989174295740447105012014826510", "34663721232646921876902289788656640253", "126908152670353824486268350638037952834", "192967101060447095411540300724681301444", "142524536747931258340736187369969869477", "54345580791670082962125927969811297509", "170453431675046463044531272571234056407", "189214032296519521703915458409380846645", "34537815367710682697895207485951025487", "254764599541815049234409217627098433658", "108130790816739613665299462183433415348", "336084678629775618112236576553406922816", "208333472269777182697594259831082163290", "277201810466962706652625822484397121514", "149945912474237222071407248688434254545", "79100489017165582330436846290194427061", "317830077990031969868366981143475471326", "135375354710215340861448296171454965415", "315001334841720570884941431941035501821", "186960515976669424991141229296562974255", "47479164954441213558063190031844484042", "157691611971073985573150076373122507930", "194383112865836704323343105931540739094", "71500152253310843065267796556867152959" ], "threshold": 0.9 }, "id": "CVE-2023-53458-9690a632", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c", "function": "cx23885_free_buffer" }, "deprecated": false, "digest": { "length": 162.0, "function_hash": "96601194521800383438159165008091229034" }, "id": "CVE-2023-53458-a2287f0f", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47e8b73bc35d7c54642f78e498697692f6358996" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c", "function": "buffer_prepare" }, "deprecated": false, "digest": { "length": 1851.0, "function_hash": "260211547535728180645598422318110128758" }, "id": "CVE-2023-53458-a2af2065", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c", "function": "cx23885_free_buffer" }, "deprecated": false, "digest": { "length": 162.0, "function_hash": "96601194521800383438159165008091229034" }, "id": "CVE-2023-53458-be9538e0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c" }, "deprecated": false, "digest": { "line_hashes": [ "221859127599352550299146787217065886198", "90426891992356106170344707910167186908", "208806630488116241976608072505926574997", "87549769964915013637772661697313186082" ], "threshold": 0.9 }, "id": "CVE-2023-53458-ca7ff674", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c", "function": "cx23885_free_buffer" }, "deprecated": false, "digest": { "length": 162.0, "function_hash": "96601194521800383438159165008091229034" }, "id": "CVE-2023-53458-cca1d344", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b8e5e28e85a546dfccc3895befe0e823fdd7c89" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-core.c" }, "deprecated": false, "digest": { "line_hashes": [ "221859127599352550299146787217065886198", "90426891992356106170344707910167186908", "208806630488116241976608072505926574997", "87549769964915013637772661697313186082" ], "threshold": 0.9 }, "id": "CVE-2023-53458-e0be7d55", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6738841f6fcf23e9fc30e2449f32fc84ee19c6f1" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "36837014071476188265492365123822887882", "192205286105346315633544626897273097499", "274147465852719504836795397501207402973", "322127831937104825704542309854525975151", "188770583609378045781371240819139662675", "122459855643367012588634341925637060710", "269278835952117136329579831013793111163", "69585035866367855909716958696237163163", "269827007499896448698874896419053974098", "300095304174692215377836949685001419562", "50615157363417912239465175079189817976", "209750803989174295740447105012014826510", "34663721232646921876902289788656640253", "126908152670353824486268350638037952834", "192967101060447095411540300724681301444", "142524536747931258340736187369969869477", "54345580791670082962125927969811297509", "170453431675046463044531272571234056407", "189214032296519521703915458409380846645", "34537815367710682697895207485951025487", "254764599541815049234409217627098433658", "108130790816739613665299462183433415348", "336084678629775618112236576553406922816", "208333472269777182697594259831082163290", "277201810466962706652625822484397121514", "149945912474237222071407248688434254545", "79100489017165582330436846290194427061", "317830077990031969868366981143475471326", "135375354710215340861448296171454965415", "315001334841720570884941431941035501821", "186960515976669424991141229296562974255", "47479164954441213558063190031844484042", "157691611971073985573150076373122507930", "194383112865836704323343105931540739094", "71500152253310843065267796556867152959" ], "threshold": 0.9 }, "id": "CVE-2023-53458-e9c15cba", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0a06203f2fe63f04311467200c99c4ee1926578" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/media/pci/cx23885/cx23885-video.c" }, "deprecated": false, "digest": { "line_hashes": [ "36837014071476188265492365123822887882", "192205286105346315633544626897273097499", "274147465852719504836795397501207402973", "322127831937104825704542309854525975151", "188770583609378045781371240819139662675", "122459855643367012588634341925637060710", "269278835952117136329579831013793111163", "69585035866367855909716958696237163163", "269827007499896448698874896419053974098", "300095304174692215377836949685001419562", "50615157363417912239465175079189817976", "209750803989174295740447105012014826510", "34663721232646921876902289788656640253", "126908152670353824486268350638037952834", "192967101060447095411540300724681301444", "142524536747931258340736187369969869477", "54345580791670082962125927969811297509", "170453431675046463044531272571234056407", "189214032296519521703915458409380846645", "34537815367710682697895207485951025487", "254764599541815049234409217627098433658", "108130790816739613665299462183433415348", "336084678629775618112236576553406922816", "208333472269777182697594259831082163290", "277201810466962706652625822484397121514", "149945912474237222071407248688434254545", "79100489017165582330436846290194427061", "317830077990031969868366981143475471326", "135375354710215340861448296171454965415", "315001334841720570884941431941035501821", "186960515976669424991141229296562974255", "47479164954441213558063190031844484042", "157691611971073985573150076373122507930", "194383112865836704323343105931540739094", "71500152253310843065267796556867152959" ], "threshold": 0.9 }, "id": "CVE-2023-53458-fb9e2e28", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6738841f6fcf23e9fc30e2449f32fc84ee19c6f1" } ] }