In the Linux kernel, the following vulnerability has been resolved:
media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish
When the driver calls tw68riscbuffer() to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer buf->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of tw68riscbuffer() and the value of buf->cpu before buffer free.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53244.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53244.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c67f49a6643d973e83968ea35806c7b5ae68b56",
"id": "CVE-2023-53244-3d0c9ea0",
"signature_version": "v1",
"target": {
"function": "tw68_buf_prepare",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "204175930634691535009008186058247430154",
"length": 1181.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0",
"id": "CVE-2023-53244-5c2b9795",
"signature_version": "v1",
"target": {
"function": "tw68_buf_prepare",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "204175930634691535009008186058247430154",
"length": 1181.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6",
"id": "CVE-2023-53244-6165bd76",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"line_hashes": [
"132188205382877332009836925136598164914",
"111161534794689435439520706534911377549",
"114861313067031862716191270218194720500",
"227665836887422614251072346752389691099",
"41239567458393720150750778419023692476",
"78249161416309519640173127067566572929",
"155689465068895053915836272907379866537",
"324388695856914350101326747745087579486",
"182814005822707178938681012531252764157",
"291640971209214860396243082187898671311",
"233605209835373738808053018058583309210",
"197525132036443174943982862547397121643",
"179553360840115315538746354393706658894",
"2283355302179518166486068921440509077",
"288680247218071285166558244312280637140",
"286443797207202997640136315022185478467",
"306235616323357276077104291020168687259",
"27397075645066424747968249058390448025",
"160535768802474445616450912628804001979",
"7966248555987535729024826639830470978",
"249529889376895448739497242877224461369",
"36103906346781736888358287666073719277",
"304128978298667550215291584411967458819",
"89178678970433857132883739515156922147",
"296161049296596516743042738724437183898",
"5032024513036303789219706273423771159",
"190650380079346569050234170439704888578",
"60923546997240157410935556652982858797",
"98057762726795341531481300557154757250",
"31381738606393576356094679395681491079",
"231593309624173503960291397641503310697",
"12836040449094093204389755484965888794",
"176529674803743739964209027301429920610",
"111350078613017137867927517271985103181",
"11780469891184208814658120500722125676"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc",
"id": "CVE-2023-53244-6535ddac",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"line_hashes": [
"132188205382877332009836925136598164914",
"111161534794689435439520706534911377549",
"114861313067031862716191270218194720500",
"227665836887422614251072346752389691099",
"41239567458393720150750778419023692476",
"78249161416309519640173127067566572929",
"155689465068895053915836272907379866537",
"324388695856914350101326747745087579486",
"182814005822707178938681012531252764157",
"291640971209214860396243082187898671311",
"233605209835373738808053018058583309210",
"197525132036443174943982862547397121643",
"179553360840115315538746354393706658894",
"2283355302179518166486068921440509077",
"288680247218071285166558244312280637140",
"286443797207202997640136315022185478467",
"306235616323357276077104291020168687259",
"27397075645066424747968249058390448025",
"160535768802474445616450912628804001979",
"7966248555987535729024826639830470978",
"249529889376895448739497242877224461369",
"36103906346781736888358287666073719277",
"304128978298667550215291584411967458819",
"89178678970433857132883739515156922147",
"296161049296596516743042738724437183898",
"5032024513036303789219706273423771159",
"190650380079346569050234170439704888578",
"60923546997240157410935556652982858797",
"98057762726795341531481300557154757250",
"31381738606393576356094679395681491079",
"231593309624173503960291397641503310697",
"12836040449094093204389755484965888794",
"176529674803743739964209027301429920610",
"111350078613017137867927517271985103181",
"11780469891184208814658120500722125676"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c67f49a6643d973e83968ea35806c7b5ae68b56",
"id": "CVE-2023-53244-672ce4fd",
"signature_version": "v1",
"target": {
"function": "tw68_buf_finish",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "264724835848455933511112270234305969205",
"length": 294.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc",
"id": "CVE-2023-53244-6ecff2b2",
"signature_version": "v1",
"target": {
"function": "tw68_buf_finish",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "264724835848455933511112270234305969205",
"length": 294.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0",
"id": "CVE-2023-53244-7fdc6b14",
"signature_version": "v1",
"target": {
"function": "tw68_buf_finish",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "264724835848455933511112270234305969205",
"length": 294.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6",
"id": "CVE-2023-53244-8ea7f040",
"signature_version": "v1",
"target": {
"function": "tw68_buf_prepare",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "204175930634691535009008186058247430154",
"length": 1181.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3715c5e9a8f96b6ed0dcbea06da443efccac1ecc",
"id": "CVE-2023-53244-9514146f",
"signature_version": "v1",
"target": {
"function": "tw68_buf_prepare",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "204175930634691535009008186058247430154",
"length": 1181.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1634b7adcc5bef645b3666fdd564e5952a9e24e0",
"id": "CVE-2023-53244-a8768609",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"line_hashes": [
"132188205382877332009836925136598164914",
"111161534794689435439520706534911377549",
"114861313067031862716191270218194720500",
"227665836887422614251072346752389691099",
"41239567458393720150750778419023692476",
"78249161416309519640173127067566572929",
"155689465068895053915836272907379866537",
"324388695856914350101326747745087579486",
"182814005822707178938681012531252764157",
"291640971209214860396243082187898671311",
"233605209835373738808053018058583309210",
"197525132036443174943982862547397121643",
"179553360840115315538746354393706658894",
"2283355302179518166486068921440509077",
"288680247218071285166558244312280637140",
"286443797207202997640136315022185478467",
"306235616323357276077104291020168687259",
"27397075645066424747968249058390448025",
"160535768802474445616450912628804001979",
"7966248555987535729024826639830470978",
"249529889376895448739497242877224461369",
"36103906346781736888358287666073719277",
"304128978298667550215291584411967458819",
"89178678970433857132883739515156922147",
"296161049296596516743042738724437183898",
"5032024513036303789219706273423771159",
"190650380079346569050234170439704888578",
"60923546997240157410935556652982858797",
"98057762726795341531481300557154757250",
"31381738606393576356094679395681491079",
"231593309624173503960291397641503310697",
"12836040449094093204389755484965888794",
"176529674803743739964209027301429920610",
"111350078613017137867927517271985103181",
"11780469891184208814658120500722125676"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dcf632bca424e6ff8c8eb89c96694e7f05cd29b6",
"id": "CVE-2023-53244-bcc718cd",
"signature_version": "v1",
"target": {
"function": "tw68_buf_finish",
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"function_hash": "264724835848455933511112270234305969205",
"length": 294.0
},
"signature_type": "Function",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c67f49a6643d973e83968ea35806c7b5ae68b56",
"id": "CVE-2023-53244-be5c77ec",
"signature_version": "v1",
"target": {
"file": "drivers/media/pci/tw68/tw68-video.c"
},
"digest": {
"line_hashes": [
"132188205382877332009836925136598164914",
"111161534794689435439520706534911377549",
"114861313067031862716191270218194720500",
"227665836887422614251072346752389691099",
"41239567458393720150750778419023692476",
"78249161416309519640173127067566572929",
"155689465068895053915836272907379866537",
"324388695856914350101326747745087579486",
"182814005822707178938681012531252764157",
"291640971209214860396243082187898671311",
"233605209835373738808053018058583309210",
"197525132036443174943982862547397121643",
"179553360840115315538746354393706658894",
"2283355302179518166486068921440509077",
"288680247218071285166558244312280637140",
"286443797207202997640136315022185478467",
"306235616323357276077104291020168687259",
"27397075645066424747968249058390448025",
"160535768802474445616450912628804001979",
"7966248555987535729024826639830470978",
"249529889376895448739497242877224461369",
"36103906346781736888358287666073719277",
"304128978298667550215291584411967458819",
"89178678970433857132883739515156922147",
"296161049296596516743042738724437183898",
"5032024513036303789219706273423771159",
"190650380079346569050234170439704888578",
"60923546997240157410935556652982858797",
"98057762726795341531481300557154757250",
"31381738606393576356094679395681491079",
"231593309624173503960291397641503310697",
"12836040449094093204389755484965888794",
"176529674803743739964209027301429920610",
"111350078613017137867927517271985103181",
"11780469891184208814658120500722125676"
],
"threshold": 0.9
},
"signature_type": "Line",
"deprecated": false
}
]