In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvbregisterdevice()
In function dvbregisterdevice() -> dvbregistermediadevice() -> dvbcreatemediaentity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvbmediadevicefree(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvbcreatemediaentity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in mediadeviceunregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50499.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0588b12c418c3e4f927ced11f27b02ef4a5bfb07",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-0200b811"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@123eddf92a114e03919942641d2c2b1f4ca56ea6",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-020a9afb"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0588b12c418c3e4f927ced11f27b02ef4a5bfb07",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1836.0,
"function_hash": "286433955147721655906201979446073282990"
},
"signature_version": "v1",
"id": "CVE-2022-50499-10650d63"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b21f62b49ee9c3e0216d685d9cfd6003e5727271",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-17f90ee7"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b0d0477fce747d4137aa65856318b55fba72198",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-271670f5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b21f62b49ee9c3e0216d685d9cfd6003e5727271",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-2ca4a030"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70bc51303871159796b55ba1a8f16637b46c2511",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-443b7e0d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@772892b29ac50c2c5e918fc80104aa6ede81d837",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-5c50a12c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@123eddf92a114e03919942641d2c2b1f4ca56ea6",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-86024b3e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acf984a3718c2458eb9e08b6714490a04f213c58",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-862955e7"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78485b658361fab6a5547377be6c1af6f1b3d",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-97fe60dd"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-a7d87072"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b0d0477fce747d4137aa65856318b55fba72198",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-be8bab5d"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@772892b29ac50c2c5e918fc80104aa6ede81d837",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-c1ab9f00"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@70bc51303871159796b55ba1a8f16637b46c2511",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-daca2048"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9a78485b658361fab6a5547377be6c1af6f1b3d",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-e7d2186f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c",
"function": "dvb_create_media_entity"
},
"digest": {
"length": 1827.0,
"function_hash": "169988062733321899874962617654577419431"
},
"signature_version": "v1",
"id": "CVE-2022-50499-eb884275"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acf984a3718c2458eb9e08b6714490a04f213c58",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/dvb-core/dvbdev.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"262402179829453449887935941761639910394",
"302304988334569543802846220382273892222",
"24150226969749657210635222367534551178",
"125425936816365186776425669734980054516"
]
},
"signature_version": "v1",
"id": "CVE-2022-50499-ec284693"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50499.json"