GHSA-VW72-9RH3-2576

Vulnerability from github – Published: 2025-10-04 18:31 – Updated: 2025-10-04 18:31
VLAI?
Details

In the Linux kernel, the following vulnerability has been resolved:

media: dvb-core: Fix double free in dvb_register_device()

In function dvb_register_device() -> dvb_register_media_device() -> dvb_create_media_entity(), dvb->entity is allocated and initialized. If the initialization fails, it frees the dvb->entity, and return an error code. The caller takes the error code and handles the error by calling dvb_media_device_free(), which unregisters the entity and frees the field again if it is not NULL. As dvb->entity may not NULLed in dvb_create_media_entity() when the allocation of dvbdev->pad fails, a double free may occur. This may also cause an Use After free in media_device_unregister_entity().

Fix this by storing NULL to dvb->entity when it is freed.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-50499"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-04T16:15:47Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: Fix double free in dvb_register_device()\n\nIn function dvb_register_device() -\u003e dvb_register_media_device() -\u003e\ndvb_create_media_entity(), dvb-\u003eentity is allocated and initialized. If\nthe initialization fails, it frees the dvb-\u003eentity, and return an error\ncode. The caller takes the error code and handles the error by calling\ndvb_media_device_free(), which unregisters the entity and frees the\nfield again if it is not NULL. As dvb-\u003eentity may not NULLed in\ndvb_create_media_entity() when the allocation of dvbdev-\u003epad fails, a\ndouble free may occur. This may also cause an Use After free in\nmedia_device_unregister_entity().\n\nFix this by storing NULL to dvb-\u003eentity when it is freed.",
  "id": "GHSA-vw72-9rh3-2576",
  "modified": "2025-10-04T18:31:14Z",
  "published": "2025-10-04T18:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50499"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0588b12c418c3e4f927ced11f27b02ef4a5bfb07"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/123eddf92a114e03919942641d2c2b1f4ca56ea6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6b0d0477fce747d4137aa65856318b55fba72198"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/70bc51303871159796b55ba1a8f16637b46c2511"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/772892b29ac50c2c5e918fc80104aa6ede81d837"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/acf984a3718c2458eb9e08b6714490a04f213c58"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b21f62b49ee9c3e0216d685d9cfd6003e5727271"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e9a78485b658361fab6a5547377be6c1af6f1b3d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.