In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix use after free on context disconnection
Upon module load, a kthread is created targeting the pvr2contextthreadfunc function, which may call pvr2contextdestroy and thus call kfree() on the context object. However, that might happen before the usb hubevent handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
{ "vanir_signatures": [ { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-5d50772b", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-7c8c9f49", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec36c134dd020d28e312c2f1766f85525e747aab" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-806c949f", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-972c3db8", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-9bfd2e93", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf0005d315549b8d2b940ff96a66c2a889aa795" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-a4321ea5", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-a476944c", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-a4fd9eb9", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-bd0f9366", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-bded5db2", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-cf8ffe55", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@437b5f57732bb4cc32cc9f8895d2010ee9ff521c" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-d81e9191", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec3634ebe23fc3c44ebc67c6d25917300bc68c08" }, { "digest": { "length": 118.0, "function_hash": "288070376354674802128510423283023829317" }, "id": "CVE-2023-52445-da067da7", "signature_version": "v1", "deprecated": false, "signature_type": "Function", "target": { "function": "pvr2_context_disconnect", "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded85b0c0edd8f45fec88783d7555a5b982449c1" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-e67c37d5", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47aa8fcd5e8b5563af4042a00f25ba89bef8f33d" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-f8e41997", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3233d8bf7893550045682192cb227af7fa3defeb" }, { "digest": { "line_hashes": [ "281129451205151595534741710845842485307", "47368168476949632402305174554640311935", "107811274798125498735693363506645089598", "296083914586674035031787357217628684114" ], "threshold": 0.9 }, "id": "CVE-2023-52445-fabba72a", "signature_version": "v1", "deprecated": false, "signature_type": "Line", "target": { "file": "drivers/media/usb/pvrusb2/pvrusb2-context.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30773ea47d41773f9611ffb4ebc9bda9d19a9e7e" } ] }