CVE-2022-49254

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49254
In the Linux kernel, the following vulnerability has been resolved: media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats() In cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to ctx->active_fmt and there is a dereference of it after that, which could lead to NULL pointer dereference on failure of devm_kzalloc(). Fix this bug by adding a NULL check of ctx->active_fmt. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4 Patch
https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004 Patch
https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608 Patch
https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

22 Sep 2025, 20:55

Type Values Removed Values Added
CWE CWE-476
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: ti-vpe: cal: Se corrige una desreferencia de puntero NULL en cal_ctx_v4l2_init_formats() En cal_ctx_v4l2_init_formats(), devm_kzalloc() se asigna a ctx->active_fmt y hay una desreferencia de este después de eso, lo que podría provocar una desreferencia de puntero NULL en caso de fallo de devm_kzalloc(). Corrija este error agregando una comprobación NULL de ctx->active_fmt. Este error fue encontrado por un analizador estático. Las compilaciones con 'make allyesconfig' no muestran nuevas advertencias y nuestro analizador estático ya no advierte sobre este código.
References () https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4 - () https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4 - Patch
References () https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004 - () https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004 - Patch
References () https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608 - () https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608 - Patch
References () https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00 - () https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00 - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-09-22 20:55

NVD link : CVE-2022-49254

Mitre link : CVE-2022-49254

CVE.ORG link : CVE-2022-49254

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference