linux-cve-announce - CVE-2023-54314: media: af9005: Fix null-ptr-deref in af9005_i2c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123037-CVE-2023-54314-a578@gregkh>
Date: Tue, 30 Dec 2025 13:24:07 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54314: media: af9005: Fix null-ptr-deref in af9005_i2c_xfer

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: af9005: Fix null-ptr-deref in af9005_i2c_xfer

In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach af9005_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")

The Linux kernel CVE team has assigned CVE-2023-54314 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.14.326 with commit 98c12abb275b75a98ff62de9466d21e4daa98536
	Fixed in 4.19.295 with commit 63d962ac7a52c0ff4cd09af2e284dce5e5955dfe
	Fixed in 5.4.257 with commit 0c02eb70b1dd4ae9bb304ce6cdadbc6faba2b2e9
	Fixed in 5.10.197 with commit c7e5ac737db25d7387fe517cb5207706782b6cf8
	Fixed in 5.15.133 with commit 033b0c0780adee32dde218179e9bc51d2525108f
	Fixed in 6.1.55 with commit abb6fd93e05e80668d2317fe1110bc99b05034c3
	Fixed in 6.5.5 with commit e595ff350b2fd600823ee8491df7df693ae4b7c5
	Fixed in 6.6 with commit f4ee84f27625ce1fdf41e8483fa0561a1b837d10

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54314
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/usb/dvb-usb/af9005.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/98c12abb275b75a98ff62de9466d21e4daa98536
	https://git.kernel.org/stable/c/63d962ac7a52c0ff4cd09af2e284dce5e5955dfe
	https://git.kernel.org/stable/c/0c02eb70b1dd4ae9bb304ce6cdadbc6faba2b2e9
	https://git.kernel.org/stable/c/c7e5ac737db25d7387fe517cb5207706782b6cf8
	https://git.kernel.org/stable/c/033b0c0780adee32dde218179e9bc51d2525108f
	https://git.kernel.org/stable/c/abb6fd93e05e80668d2317fe1110bc99b05034c3
	https://git.kernel.org/stable/c/e595ff350b2fd600823ee8491df7df693ae4b7c5
	https://git.kernel.org/stable/c/f4ee84f27625ce1fdf41e8483fa0561a1b837d10