In the Linux kernel, the following vulnerability has been resolved:
media: az6007: Fix null-ptr-deref in az6007i2cxfer()
In az6007i2cxfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007i2cxfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027i2cxfer()")
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53220.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53220.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ab7ea4e17d6a605d05308adf8f3408924770cba",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-01ec377a",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b1ea100ad3695025969dc4693f307877fb688d6",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-1ae6111e",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1110f19d4940e4185251d072cbb0ff51486a1e7",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-1d5fde9f",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a1110f19d4940e4185251d072cbb0ff51486a1e7",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-23bfed9d",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@991c77fe18c6f374bbf83376f8c42550aa565662",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-26e4af7b",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b1ea100ad3695025969dc4693f307877fb688d6",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-2768b53c",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adcb73f8ce9aec48b1f85223f401c1574015d8d2",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-4a61f45b",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@991c77fe18c6f374bbf83376f8c42550aa565662",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-536ac2d1",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@adcb73f8ce9aec48b1f85223f401c1574015d8d2",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-53cad82a",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6763fefa267f6e62595a6ac1f57815d99fc90b7",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-831ef87a",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6763fefa267f6e62595a6ac1f57815d99fc90b7",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-99f51e22",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9def3e9718a4dc756f48db147d42ec41a966240",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-9d052f23",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1047f9343011f2cedc73c64829686206a7e9fc3f",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-9ec5664d",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1047f9343011f2cedc73c64829686206a7e9fc3f",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-d01ae0cf",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9def3e9718a4dc756f48db147d42ec41a966240",
"signature_type": "Line",
"digest": {
"line_hashes": [
"187031130083698175045771217077790754617",
"204018133865557086593160643537553363740",
"216074245950631802152439317164014434398",
"52489105256671658085481723987326872324",
"269441975380729041022097102739169289091",
"115302643082723829112939521456953519727",
"246670040096025514331325843397175981675",
"188210010562456442421226717534788693802"
],
"threshold": 0.9
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c"
},
"id": "CVE-2023-53220-d575c26f",
"signature_version": "v1"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ab7ea4e17d6a605d05308adf8f3408924770cba",
"signature_type": "Function",
"digest": {
"function_hash": "48932312995491055523685116722927678970",
"length": 2148.0
},
"deprecated": false,
"target": {
"file": "drivers/media/usb/dvb-usb-v2/az6007.c",
"function": "az6007_i2c_xfer"
},
"id": "CVE-2023-53220-f3de3cfa",
"signature_version": "v1"
}
]