Bug 2123310 (CVE-2022-3078) - CVE-2022-3078 kernel: NULL pointer dereference in drivers/media/test-drivers/vidtv/vidtv_s302m.c
Summary: CVE-2022-3078 kernel: NULL pointer dereference in drivers/media/test-drivers/...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-3078
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2123312
Blocks: 2116450
TreeView+ depends on / blocked
 
Reported: 2022-09-01 11:11 UTC by Alex
Modified: 2022-09-20 14:10 UTC (History)
52 users (show)

Fixed In Version: Linux kernel 5.18-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel. There is a lack of check after calling vzalloc() and a lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
Clone Of:
Environment:
Last Closed: 2022-09-01 11:21:33 UTC

Attachments (Terms of Use)

Description Alex 2022-09-01 11:11:59 UTC 
An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after
allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e6a21a14106d9718aa4f8e115b1e474888eeba44
Comment 1 Alex 2022-09-01 11:12:33 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2123312]
Comment 3 Salvatore Bonaccorso 2022-09-02 04:59:10 UTC 
Is the fixed version information correct? The fixing commit seems to be in 5.18-rc1 (and was backported to 5.17.2, 5.16.19, 5.15.33 and 5.10.110).
Comment 4 Alex 2022-09-04 11:28:06 UTC 
Thank you, updated to the Linux kernel 5.18-rc1.
Comment 5 Justin M. Forbes 2022-09-20 14:10:39 UTC 
These drivers were not enabled for Fedora, but for users building their own kernels, it was fixed in the 5.16.19 stable updates source tree.
Note You need to log in before you can comment on or make changes to this bug.