CVE-2022-50745
Description
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk.
How to fix
- Linux Linux5451efb2ca30f3c42b9efb8327ce35b62870dbd3, ce50c612458091d926ccb05d7db11d9f93532db2, 6512c9498fcb97e7c760e3ef86b2272f2c0f765f, 0fd003d3c708c80350a815eaf37b8e1114b976cf, c4d344163c3a7f90712525f931a6c016bbb35e18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1ebaeb09830f36c1111b72a95420814225bd761c ≤ v < 5451efb2ca30f3c42b9efb8327ce35b62870dbd3, 1ebaeb09830f36c1111b72a95420814225bd761c ≤ v < ce50c612458091d926ccb05d7db11d9f93532db2, 1ebaeb09830f36c1111b72a95420814225bd761c ≤ v < 6512c9498fcb97e7c760e3ef86b2272f2c0f765f, 1ebaeb09830f36c1111b72a95420814225bd761c ≤ v < 0fd003d3c708c80350a815eaf37b8e1114b976cf, 1ebaeb09830f36c1111b72a95420814225bd761c ≤ v < c4d344163c3a7f90712525f931a6c016bbb35e18, 5.10 | 5451efb2ca30f3c42b9efb8327ce35b62870dbd3, ce50c612458091d926ccb05d7db11d9f93532db2, 6512c9498fcb97e7c760e3ef86b2272f2c0f765f, 0fd003d3c708c80350a815eaf37b8e1114b976cf, c4d344163c3a7f90712525f931a6c016bbb35e18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.