Description
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: initialize local pointers upon transfer of memory ownership vidtv_channel_si_init() creates a temporary list (program, service, event) and ownership of the memory itself is transferred to the PAT/SDT/EIT tables through vidtv_psi_pat_program_assign(), vidtv_psi_sdt_service_assign(), vidtv_psi_eit_event_assign(). The problem here is that the local pointer where the memory ownership transfer was completed is not initialized to NULL. This causes the vidtv_psi_pmt_create_sec_for_each_pat_entry() function to fail, and in the flow that jumps to free_eit, the memory that was freed by vidtv_psi_*_table_destroy() can be accessed again by vidtv_psi_*_event_destroy() due to the uninitialized local pointer, so it is freed once again. Therefore, to prevent use-after-free and double-free vulnerability, local pointers must be initialized to NULL when transferring memory ownership.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3be8037960bccd13052cfdeba8805ad785041d70 to < c342e294dac4988c8ada759b2f057246e48c5108affected3be8037960bccd13052cfdeba8805ad785041d70 to < 12ab6ebb37789b84073e83e4d9b14a5e0d133323affected3be8037960bccd13052cfdeba8805ad785041d70 to < 3caa18d35f1dabe85a3dd31bc387f391ac9f9b4eaffected3be8037960bccd13052cfdeba8805ad785041d70 to < fb9bd6d8d314b748e946ed6555eb4a956ee8c4d8affected3be8037960bccd13052cfdeba8805ad785041d70 to < a69c7fd603bf5ad93177394fbd9711922ee81032affected3be8037960bccd13052cfdeba8805ad785041d70 to < 30f4d4e5224a9e44e9ceb3956489462319d804ceaffected3be8037960bccd13052cfdeba8805ad785041d70 to < 98aabfe2d79f74613abc2b0b1cef08f97eaf5322affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected5.10.248 to ≤ 5.10.*unaffected5.15.198 to ≤ 5.15.*unaffected6.1.160 to ≤ 6.1.*unaffected6.6.120 to ≤ 6.6.*unaffected6.12.64 to ≤ 6.12.*unaffected6.18.3 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c342e294dac4988c8ada759b2f057246e48c5108 ↗
- https://git.kernel.org/stable/c/12ab6ebb37789b84073e83e4d9b14a5e0d133323 ↗
- https://git.kernel.org/stable/c/3caa18d35f1dabe85a3dd31bc387f391ac9f9b4e ↗
- https://git.kernel.org/stable/c/fb9bd6d8d314b748e946ed6555eb4a956ee8c4d8 ↗
- https://git.kernel.org/stable/c/a69c7fd603bf5ad93177394fbd9711922ee81032 ↗
- https://git.kernel.org/stable/c/30f4d4e5224a9e44e9ceb3956489462319d804ce ↗
- https://git.kernel.org/stable/c/98aabfe2d79f74613abc2b0b1cef08f97eaf5322 ↗