linux-cve-announce - CVE-2021-47644: media: staging: media: zoran: move videodev alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022648-CVE-2021-47644-b267@gregkh>
Date: Wed, 26 Feb 2025 02:53:55 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47644: media: staging: media: zoran: move videodev alloc

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: staging: media: zoran: move videodev alloc

Move some code out of zr36057_init() and create new functions for handling
zr->video_dev. This permit to ease code reading and fix a zr->video_dev
memory leak.

The Linux kernel CVE team has assigned CVE-2021-47644 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.110 with commit bd01629315ffd5b63da91d0bd529a77d30e55028
	Fixed in 5.15.33 with commit ff3357bffd9fb78f59762d8955afc7382a279079
	Fixed in 5.16.19 with commit c1ba65100a359fe28cfe37e09e10c99f247cbf1e
	Fixed in 5.17.2 with commit 1e501ec38796f43e995731d1bcd4173cb1ccfce0
	Fixed in 5.18 with commit 82e3a496eb56da0b9f29fdc5b63cedb3289e91de

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47644
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/media/zoran/zoran.h
	drivers/staging/media/zoran/zoran_card.c
	drivers/staging/media/zoran/zoran_driver.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/bd01629315ffd5b63da91d0bd529a77d30e55028
	https://git.kernel.org/stable/c/ff3357bffd9fb78f59762d8955afc7382a279079
	https://git.kernel.org/stable/c/c1ba65100a359fe28cfe37e09e10c99f247cbf1e
	https://git.kernel.org/stable/c/1e501ec38796f43e995731d1bcd4173cb1ccfce0
	https://git.kernel.org/stable/c/82e3a496eb56da0b9f29fdc5b63cedb3289e91de