In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov772x: Fix memleak in ov772x_probe()
A memory leak was reported when testing ov772x with bpf mock device:
AssertionError: unreferenced object 0xffff888109afa7a8 (size 8): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 8 bytes): 80 22 88 15 81 88 ff ff ."...... backtrace: [<000000009990b438>] __kmallocnode+0x44/0x1b0 [<000000009e32f7d7>] kvmallocnode+0x34/0x180 [<00000000faf48134>] v4l2ctrlhandlerinitclass+0x11d/0x180 [videodev] [<00000000da376937>] ov772xprobe+0x1c3/0x68c [ov772x] [<000000003f0d225e>] i2cdeviceprobe+0x28d/0x680 [<00000000e0b6db89>] reallyprobe+0x17c/0x3f0 [<000000001b19fcee>] __driverprobedevice+0xe3/0x170 [<0000000048370519>] driverprobedevice+0x49/0x120 [<000000005ead07a0>] __deviceattachdriver+0xf7/0x150 [<0000000043f452b8>] bus_foreachdrv+0x114/0x180 [<00000000358e5596>] __deviceattach+0x1e5/0x2d0 [<0000000043f83c5d>] busprobedevice+0x126/0x140 [<00000000ee0f3046>] deviceadd+0x810/0x1130 [<00000000e0278184>] i2cnewclientdevice+0x359/0x4f0 [<0000000070baf34f>] ofi2cregisterdevice+0xf1/0x110 [<00000000a9f2159d>] ofi2cnotify+0x100/0x160 unreferenced object 0xffff888119825c00 (size 256): comm "python3", pid 279, jiffies 4294805921 (age 20.681s) hex dump (first 32 bytes): 00 b4 a5 17 81 88 ff ff 00 5e 82 19 81 88 ff ff .........^...... 10 5c 82 19 81 88 ff ff 10 5c 82 19 81 88 ff ff .............. backtrace: [<000000009990b438>] __kmallocnode+0x44/0x1b0 [<000000009e32f7d7>] kvmallocnode+0x34/0x180 [<0000000073d88e0b>] v4l2ctrlnew.cold+0x19b/0x86f [videodev] [<00000000b1f576fb>] v4l2ctrlnewstd+0x16f/0x210 [videodev] [<00000000caf7ac99>] ov772xprobe+0x1fa/0x68c [ov772x] [<000000003f0d225e>] i2cdeviceprobe+0x28d/0x680 [<00000000e0b6db89>] really_probe+0x17c/0x3f0 [<000000001b19fcee>] __driverprobedevice+0xe3/0x170 [<0000000048370519>] driverprobedevice+0x49/0x120 [<000000005ead07a0>] __deviceattachdriver+0xf7/0x150 [<0000000043f452b8>] bus_foreachdrv+0x114/0x180 [<00000000358e5596>] __deviceattach+0x1e5/0x2d0 [<0000000043f83c5d>] busprobedevice+0x126/0x140 [<00000000ee0f3046>] deviceadd+0x810/0x1130 [<00000000e0278184>] i2cnewclientdevice+0x359/0x4f0 [<0000000070baf34f>] ofi2cregisterdevice+0xf1/0x110
The reason is that if priv->hdl.error is set, ov772xprobe() jumps to the errormutexdestroy without doing v4l2ctrlhandlerfree(), and all resources allocated in v4l2ctrlhandlerinit() and v4l2ctrlnewstd() are leaked.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53637.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac93f8ac66e60227bed42d5a023f0e6c15b52c0a",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-2019b878"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc3b6011d7a9f149489eb9420c6305a779162c57",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-6ec8785c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1da495101ef7507eb4f4b1dbec2874d740eff251",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-71ca1f53"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfaafeb8e9537969e8dba75491f732478c7fa9d6",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-75426402"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c86d760c1c6855a6131e78d0ddacc48c79324ac3",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2796.0,
"function_hash": "58525539401694801101041991482518391353"
},
"signature_version": "v1",
"id": "CVE-2023-53637-7591f3f5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c86d760c1c6855a6131e78d0ddacc48c79324ac3",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-78e266f2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfaafeb8e9537969e8dba75491f732478c7fa9d6",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2580.0,
"function_hash": "66831616646185636906533170115705797075"
},
"signature_version": "v1",
"id": "CVE-2023-53637-7fa22a4e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7485edb2b6ca5960205c0a49bedfd09bba30e521",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2796.0,
"function_hash": "58525539401694801101041991482518391353"
},
"signature_version": "v1",
"id": "CVE-2023-53637-8249332c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@448ce1cd50387b1345ec14eb191ef05f7afc2a26",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2580.0,
"function_hash": "66831616646185636906533170115705797075"
},
"signature_version": "v1",
"id": "CVE-2023-53637-8490cde2"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1da495101ef7507eb4f4b1dbec2874d740eff251",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2796.0,
"function_hash": "58525539401694801101041991482518391353"
},
"signature_version": "v1",
"id": "CVE-2023-53637-c71a30e6"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac93f8ac66e60227bed42d5a023f0e6c15b52c0a",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2796.0,
"function_hash": "58525539401694801101041991482518391353"
},
"signature_version": "v1",
"id": "CVE-2023-53637-cc71d7ba"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7485edb2b6ca5960205c0a49bedfd09bba30e521",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-ce06d915"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc3b6011d7a9f149489eb9420c6305a779162c57",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/media/i2c/ov772x.c",
"function": "ov772x_probe"
},
"digest": {
"length": 2474.0,
"function_hash": "299851213242579583891534481223949363183"
},
"signature_version": "v1",
"id": "CVE-2023-53637-ce67d8c0"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@448ce1cd50387b1345ec14eb191ef05f7afc2a26",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/media/i2c/ov772x.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"165297610212134264428476681453443085042",
"251745371573096189977080623391189611172",
"120223788400885571526296680038849286405",
"198009648842656341360089664089761373370",
"306528488338343851114469430779814018014",
"188780885414433101007010140653153283571",
"163462956665198584713353231660172014977",
"280406152822282955203218182200916535072"
]
},
"signature_version": "v1",
"id": "CVE-2023-53637-e9ab040a"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53637.json"