CVE-2022-50745: staging: media: tegra-video: fix device_node use after free
In the Linux kernel, the following vulnerability has been resolved:
staging: media: tegra-video: fix devicenode use after free
At probe time this code path is followed:
tegracsiinit tegracsichannelsalloc foreachchildofnode(node, channel) -- iterates over channels automatically gets 'channel' tegracsichannelalloc() saves into chan->ofnode a pointer to the channel OF node automatically gets and puts 'channel' now the node saved in chan->ofnode has refcount 0, can disappear tegracsichannelsinit iterates over channels tegracsichannelinit -- uses chan->ofnode
After that, chan->ofnode keeps storing the node until the device is removed.
ofnodeget() the node and ofnodeput() it during teardown to avoid any risk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50745?
CVE-2022-50745 has been rated as having a high severity due to the potential for exploitation leading to system instability.
How do I fix CVE-2022-50745?
To fix CVE-2022-50745, upgrade to the latest stable version of the Linux kernel that includes the patch.
Which versions of Linux kernel are affected by CVE-2022-50745?
CVE-2022-50745 affects specific versions of the Linux kernel with the staging: media: tegra-video module.
What components are involved in the CVE-2022-50745 vulnerability?
The CVE-2022-50745 vulnerability involves the tegra_csi_init and tegra_csi_channels_alloc functions within the Linux kernel.
Can CVE-2022-50745 lead to remote code execution?
CVE-2022-50745 does not directly lead to remote code execution but can cause system instability which may be exploited in certain scenarios.