In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885_initdev() When the driver fails to call the dma_set_mask(), the driver will get the following splat: [ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 [ 55.856822] Call Trace: [ 55.860327] __process_removed_driver+0x3c/0x240 [ 55.861347] bus_for_each_dev+0x102/0x160 [ 55.861681] i2c_del_driver+0x2f/0x50 This is because the driver has initialized the i2c related resources in cx23885_dev_setup() but not released them in error handling, fix this bug by modifying the error path that jumps after failing to call the dma_set_mask().

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/453514a874c78df1e7804e6e3aaa60c8d8deb6a8 cve-icon cve-icon
https://git.kernel.org/stable/c/6041d1a0365baa729b6adfb6ed5386d9388018db cve-icon cve-icon
https://git.kernel.org/stable/c/7b9978e1c94e569d65a0e7e719abb9340f5db4a0 cve-icon cve-icon
https://git.kernel.org/stable/c/86bd6a579c6c60547706cabf299cd2c9feab3332 cve-icon cve-icon
https://git.kernel.org/stable/c/98106f100f50c487469903b9cf6d966785fc9cc3 cve-icon cve-icon
https://git.kernel.org/stable/c/ca17e7a532d1a55466cc007b3f4d319541a27493 cve-icon cve-icon
https://git.kernel.org/stable/c/e8123311cf06d7dae71e8c5fe78e0510d20cd30b cve-icon cve-icon
https://git.kernel.org/stable/c/fa636e9ee4442215cd9a2e079cd5a8e1fe0cb8ba cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025022611-CVE-2022-49524-74f0@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2022-49524 cve-icon
https://www.cve.org/CVERecord?id=CVE-2022-49524 cve-icon
History

Mon, 24 Mar 2025 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Tue, 04 Mar 2025 03:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 27 Feb 2025 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 27 Feb 2025 01:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 26 Feb 2025 02:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: Fix the error handling in cx23885_initdev() When the driver fails to call the dma_set_mask(), the driver will get the following splat: [ 55.853884] BUG: KASAN: use-after-free in __process_removed_driver+0x3c/0x240 [ 55.854486] Read of size 8 at addr ffff88810de60408 by task modprobe/590 [ 55.856822] Call Trace: [ 55.860327] __process_removed_driver+0x3c/0x240 [ 55.861347] bus_for_each_dev+0x102/0x160 [ 55.861681] i2c_del_driver+0x2f/0x50 This is because the driver has initialized the i2c related resources in cx23885_dev_setup() but not released them in error handling, fix this bug by modifying the error path that jumps after failing to call the dma_set_mask().
Title media: pci: cx23885: Fix the error handling in cx23885_initdev()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-02-26T02:13:48.222Z

Updated: 2025-02-27T18:22:31.915Z

Reserved: 2025-02-26T02:08:31.588Z

Link: CVE-2022-49524

cve-icon Vulnrichment

Updated: 2025-02-27T18:15:39.237Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2025-02-26T07:01:28.407

Modified: 2025-03-24T19:43:42.333

Link: CVE-2022-49524

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-02-26T00:00:00Z

Links: CVE-2022-49524 - Bugzilla