linux-cve-announce - CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091512-CVE-2023-53220-e514@gregkh>
Date: Mon, 15 Sep 2025 16:21:54 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53220: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()

In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach az6007_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

The Linux kernel CVE team has assigned CVE-2023-53220 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.326 with commit c6763fefa267f6e62595a6ac1f57815d99fc90b7
	Fixed in 4.19.295 with commit adcb73f8ce9aec48b1f85223f401c1574015d8d2
	Fixed in 5.4.257 with commit 991c77fe18c6f374bbf83376f8c42550aa565662
	Fixed in 5.10.197 with commit a9def3e9718a4dc756f48db147d42ec41a966240
	Fixed in 5.15.133 with commit 5b1ea100ad3695025969dc4693f307877fb688d6
	Fixed in 6.1.55 with commit 6ab7ea4e17d6a605d05308adf8f3408924770cba
	Fixed in 6.5.5 with commit a1110f19d4940e4185251d072cbb0ff51486a1e7
	Fixed in 6.6 with commit 1047f9343011f2cedc73c64829686206a7e9fc3f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53220
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/usb/dvb-usb-v2/az6007.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7
	https://git.kernel.org/stable/c/adcb73f8ce9aec48b1f85223f401c1574015d8d2
	https://git.kernel.org/stable/c/991c77fe18c6f374bbf83376f8c42550aa565662
	https://git.kernel.org/stable/c/a9def3e9718a4dc756f48db147d42ec41a966240
	https://git.kernel.org/stable/c/5b1ea100ad3695025969dc4693f307877fb688d6
	https://git.kernel.org/stable/c/6ab7ea4e17d6a605d05308adf8f3408924770cba
	https://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7
	https://git.kernel.org/stable/c/1047f9343011f2cedc73c64829686206a7e9fc3f