CVE-2024-56769: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000writereg
Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000readreg().
Local u8 rb[2] is used in i2ctransfer() as a read buffer; in case that call fails, the buffer may end up with some undefined values.
Since no elaborate error handling is expected in dib3000writereg(), simply zero out rb buffer to mitigate the problem.
[1] Syzkaller report dvb-usb: bulk message failed: -22 (6/0) ===================================================== BUG: KMSAN: uninit-value in dib3000mbattach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dib3000mbattach+0x2d8/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 dibusbdib3000mbfrontendattach+0x155/0x2f0 drivers/media/usb/dvb-usb/dibusb-mb.c:31 dvbusbadapterfrontendinit+0xed/0x9a0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290 dvbusbadapterinit drivers/media/usb/dvb-usb/dvb-usb-init.c:90 [inline] dvbusbinit drivers/media/usb/dvb-usb/dvb-usb-init.c:186 [inline] dvbusbdeviceinit+0x25a8/0x3760 drivers/media/usb/dvb-usb/dvb-usb-init.c:310 dibusbprobe+0x46/0x250 drivers/media/usb/dvb-usb/dibusb-mb.c:110 ... Local variable rb created at: dib3000readreg+0x86/0x4e0 drivers/media/dvb-frontends/dib3000mb.c:54 dib3000mbattach+0x123/0x3c0 drivers/media/dvb-frontends/dib3000mb.c:758 ...
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56769?
CVE-2024-56769 has a severity rating that indicates a moderate risk due to the potential for uninitialized value exposure, impacting system reliability.
How do I fix CVE-2024-56769?
To fix CVE-2024-56769, update the Linux kernel to a version that includes the patch for this vulnerability.
What software is affected by CVE-2024-56769?
CVE-2024-56769 affects various versions of the Linux kernel, particularly those between 2.6.19 and 6.1.123, 6.2 to 6.6.69, and 6.7 to 6.12.8.
What type of vulnerability is CVE-2024-56769?
CVE-2024-56769 is categorized as an uninitialized value vulnerability found in the Linux kernel's media subsystem.
Can CVE-2024-56769 be exploited remotely?
CVE-2024-56769 is not considered a remote exploit vulnerability as it requires local access to the affected system.