linux-cve-announce - CVE-2023-54093: media: anysee: fix null-ptr-deref in anysee_master

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122407-CVE-2023-54093-fcea@gregkh>
Date: Wed, 24 Dec 2025 14:06:50 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54093: media: anysee: fix null-ptr-deref in anysee_master_xfer

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: anysee: fix null-ptr-deref in anysee_master_xfer

In anysee_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach anysee_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

[hverkuil: add spaces around +]

The Linux kernel CVE team has assigned CVE-2023-54093 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.326 with commit 73c0b224ceeba12dee2a7a8cbc147648da0b2e63
	Fixed in 4.19.295 with commit e04affec2506ff5c12a18d78d7e694b3556a8982
	Fixed in 5.4.257 with commit 8dc5b370254abc10f0cb4141d90cecf7ce465472
	Fixed in 5.10.197 with commit 4a9763d2bc4a6d6fab42555b9c0b2eefa32585ac
	Fixed in 5.15.133 with commit 3dd5846a873938ec7b6d404ec27662942cd8f2ef
	Fixed in 6.1.55 with commit 14b94154a72388b57221a2a73795c0ea61a95373
	Fixed in 6.5.5 with commit 5975dbbb7ad0767eaabd15d2c37a739ac76acb00
	Fixed in 6.6 with commit c30411266fd67ea3c02a05c157231654d5a3bdc9

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54093
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/usb/dvb-usb-v2/anysee.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/73c0b224ceeba12dee2a7a8cbc147648da0b2e63
	https://git.kernel.org/stable/c/e04affec2506ff5c12a18d78d7e694b3556a8982
	https://git.kernel.org/stable/c/8dc5b370254abc10f0cb4141d90cecf7ce465472
	https://git.kernel.org/stable/c/4a9763d2bc4a6d6fab42555b9c0b2eefa32585ac
	https://git.kernel.org/stable/c/3dd5846a873938ec7b6d404ec27662942cd8f2ef
	https://git.kernel.org/stable/c/14b94154a72388b57221a2a73795c0ea61a95373
	https://git.kernel.org/stable/c/5975dbbb7ad0767eaabd15d2c37a739ac76acb00
	https://git.kernel.org/stable/c/c30411266fd67ea3c02a05c157231654d5a3bdc9