In the Linux kernel, the following vulnerability has been resolved:
media: bttv: fix use after free error due to btv->timeout timer
There may be some a race condition between timer function bttvirqtimeout and bttvremove. The timer is setup in probe and there is no timerdelete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug.
This bug is found by static analysis, it may be false positive.
Fix it by adding deltimersync invoking to the remove function.
cpu0 cpu1 bttvprobe ->timersetup ->bttvsetdma ->modtimer; bttvremove ->kfree(btv); ->bttvirqtimeout ->USE btv
{ "vanir_signatures": [ { "id": "CVE-2023-52847-089f90b6", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3d9198cdae1cb079ec8652f4defacd481eab2b", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-08c7e654", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847599fffa528b2cdec4e21b6bf7586dad982132", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-0d198ef1", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-1d909a7b", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51c94256a83fe4e17406c66ff3e1ad7d242d8574", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-35507f5a", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847599fffa528b2cdec4e21b6bf7586dad982132", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-3be66fa8", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51c94256a83fe4e17406c66ff3e1ad7d242d8574", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-5a660982", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3d9198cdae1cb079ec8652f4defacd481eab2b", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-5cdd82e7", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35fdade92c5058a5e727e233fe263b828de2c9a", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-73f2c50d", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd5b50b329e850d467e7bcc07b2b6bde3752fbda", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-7aba8b87", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1871014d6ef4812ad11ef7d838d73ce09d632267", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-8829263c", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1871014d6ef4812ad11ef7d838d73ce09d632267", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-9abb213e", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b35fdade92c5058a5e727e233fe263b828de2c9a", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-a88b25d8", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20568d06f6069cb835e05eed432edf962645d226", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-bc5de365", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-c1f7a0d2", "signature_type": "Function", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c", "function": "bttv_remove" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd5b50b329e850d467e7bcc07b2b6bde3752fbda", "digest": { "function_hash": "290764979195323230470533169316485795845", "length": 958.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2023-52847-eedcb706", "signature_type": "Line", "target": { "file": "drivers/media/pci/bt8xx/bttv-driver.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20568d06f6069cb835e05eed432edf962645d226", "digest": { "threshold": 0.9, "line_hashes": [ "218426317471302794733465122414542257739", "14177672615694424990617028854759783844", "295132003330078393746750022620118169511", "176440862666338128757484794246774317175" ] }, "deprecated": false, "signature_version": "v1" } ] }