Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2022-50745

staging: media: tegra-video: fix device_node use after free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1ebaeb09830f36c1111b72a95420814225bd761c to < 5451efb2ca30f3c42b9efb8327ce35b62870dbd3affected
  • 1ebaeb09830f36c1111b72a95420814225bd761c to < ce50c612458091d926ccb05d7db11d9f93532db2affected
  • 1ebaeb09830f36c1111b72a95420814225bd761c to < 6512c9498fcb97e7c760e3ef86b2272f2c0f765faffected
  • 1ebaeb09830f36c1111b72a95420814225bd761c to < 0fd003d3c708c80350a815eaf37b8e1114b976cfaffected
  • 1ebaeb09830f36c1111b72a95420814225bd761c to < c4d344163c3a7f90712525f931a6c016bbb35e18affected

Linux Linux

Default version status: affected

  • 5.10affected
  • 0 to < 5.10unaffected
  • 5.10.163 to ≤ 5.10.*unaffected
  • 5.15.87 to ≤ 5.15.*unaffected
  • 6.0.18 to ≤ 6.0.*unaffected
  • 6.1.4 to ≤ 6.1.*unaffected
  • 6.2 to ≤ *unaffected

References