Bug 2153058 (CVE-2022-3115)

Summary:	CVE-2022-3115 kernel: drm: mali-dp: NULL pointer dereference in malidp_crtc_reset()
Product:	[Other] Security Response	Reporter:	Sage McTaggart <amctagga>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hariharank, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpazdziora, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, mcascell, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, vsroka, walters, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 5.19-rc1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-12 19:02:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2153051

Description Sage McTaggart 2022-12-13 21:58:25 UTC

[Suggested description]
An issue was discovered in the Linux kernel through 5.16-rc6.
malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of
the return value of kzalloc() and will cause the null pointer
dereference.

------------------------------------------

[VulnerabilityType Other]
NULL Pointer Dereference

------------------------------------------

[Vendor of Product]
the development group

------------------------------------------

[Affected Product Code Base]
Linux kernel - 5.16-rc6

------------------------------------------

[Reference]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=73c3ed7495c67b8fbdc31cf58e6ca8757df31a33

------------------------------------------

[Discoverer]
Jiasheng Jiang

Comment 5 Mauro Matteo Cascella 2023-06-12 08:37:14 UTC

Upstream commit:
https://github.com/torvalds/linux/commit/73c3ed7495c67b8fbdc31cf58e6ca8757df31a33

Comment 6 Product Security DevOps Team 2023-06-12 19:01:59 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-3115

Comment 7 Jan Pazdziora (Red Hat) 2023-07-29 07:42:05 UTC

Hello,

given comment 2 limits the scope to ARM but does not rule out that the code is in the RHEL kernel, shouldn't this be reopened for proper investigation of the situation in RHEL aarch64 versions?

Thank you, Jan