linux-cve-announce - CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100132-CVE-2023-53519-de9d@gregkh>
Date: Wed,  1 Oct 2025 13:46:11 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53519: media: v4l2-mem2mem: add lock to protect parameter num_rdy

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-mem2mem: add lock to protect parameter num_rdy

Getting below error when using KCSAN to check the driver. Adding lock to
protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.

kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
kworker/u16:3: [name:report&]

kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3:  v4l2_m2m_buf_queue+0xd8/0x10c

The Linux kernel CVE team has assigned CVE-2023-53519 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.324 with commit 690dd4780b3f4d755e4e7883e8c3d1b5052f6bf2
	Fixed in 4.19.293 with commit 7fc7f87725805197388ba749a1801df33000fa50
	Fixed in 5.4.255 with commit ef009fe2010ea2a3a7045ecb72729cf366e0967b
	Fixed in 5.10.192 with commit e52de26cb37459b16213438a2c82feb155dd3bbd
	Fixed in 5.15.128 with commit 1676748aa29099fc0abd71e0fb092e76e835f25c
	Fixed in 6.1.47 with commit c71aa5f1cf961264690f2560503ea396b6e3c680
	Fixed in 6.4.12 with commit e01ea1c4191ee08440b5f86db98dff695e9cedf9
	Fixed in 6.5 with commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53519
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/media/v4l2-mem2mem.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/690dd4780b3f4d755e4e7883e8c3d1b5052f6bf2
	https://git.kernel.org/stable/c/7fc7f87725805197388ba749a1801df33000fa50
	https://git.kernel.org/stable/c/ef009fe2010ea2a3a7045ecb72729cf366e0967b
	https://git.kernel.org/stable/c/e52de26cb37459b16213438a2c82feb155dd3bbd
	https://git.kernel.org/stable/c/1676748aa29099fc0abd71e0fb092e76e835f25c
	https://git.kernel.org/stable/c/c71aa5f1cf961264690f2560503ea396b6e3c680
	https://git.kernel.org/stable/c/e01ea1c4191ee08440b5f86db98dff695e9cedf9
	https://git.kernel.org/stable/c/56b5c3e67b0f9af3f45cf393be048ee8d8a92694