media: pvrusb2: fix use after free on context disconnection Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2267102]
This was fixed for Fedora with the 6.6.14 stable kernel update.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3618 https://access.redhat.com/errata/RHSA-2024:3618
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:3627 https://access.redhat.com/errata/RHSA-2024:3627
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2023-52445 is: CHECK Maybe valid. Check manually. with impact LOW (that is an approximation based on flags USB INIT SIMPLEFIX RACE UAF IMPROVEONLY ; these flags parsed automatically based on patch data). Such automatic check happens only for Low/Moderates (and only when not from reporter, but parsing already existing CVE). Highs always checked manually (I check it myself and then we check it again in Remediation team). In rare cases some of the Moderates could be increased to High later.
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315