In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix double free in error path
If the uvcstatusinit() function fails to allocate the inturb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvcstatus_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it.
Reviewed by: Ricardo Ribalda ribalda@chromium.org
[
{
"id": "CVE-2024-57980-1d702bb6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"245352102923870337832700758427262729244",
"39302874139103213609512909264340822054",
"160126380905527432113376877481110356805",
"71046590306829504038916134996295822967"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9232719ac9ce4d5c213cebda23d72aec3e1c4c0d",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c"
}
},
{
"id": "CVE-2024-57980-53f0bd90",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"23373429685379484791061673504358123548",
"204808316280510099857868018724654360257",
"267199266569255229780135098560069253334",
"71046590306829504038916134996295822967"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c36dcd662ec5276782838660f8533a7cb26be49",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c"
}
},
{
"id": "CVE-2024-57980-617e3eb1",
"signature_version": "v1",
"digest": {
"function_hash": "170955094743913762062907272649120839651",
"length": 826.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c",
"function": "uvc_status_init"
}
},
{
"id": "CVE-2024-57980-7e7c21e7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"23373429685379484791061673504358123548",
"204808316280510099857868018724654360257",
"267199266569255229780135098560069253334",
"71046590306829504038916134996295822967"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c"
}
},
{
"id": "CVE-2024-57980-87532a9b",
"signature_version": "v1",
"digest": {
"function_hash": "221044149633723700205161288814650389978",
"length": 788.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c36dcd662ec5276782838660f8533a7cb26be49",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c",
"function": "uvc_status_init"
}
},
{
"id": "CVE-2024-57980-d5724046",
"signature_version": "v1",
"digest": {
"function_hash": "226956392543791714307084065233938025605",
"length": 782.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9232719ac9ce4d5c213cebda23d72aec3e1c4c0d",
"target": {
"file": "drivers/media/usb/uvc/uvc_status.c",
"function": "uvc_status_init"
}
}
]