In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Fix a null-ptr-deref bug in bufferprepare() and bufferfinish()
When the driver calls cx23885riscbuffer() to prepare the buffer, the function call dmaalloccoherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered.
This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.
We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885riscbuffer() and the value of risc->cpu before buffer free.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53458.json",
"cna_assigner": "Linux"
}