CVE-2022-48772

media: lgdt3306a: Add a check against null-pointer-def

State: Published
Severity: Not scored
Published: Jun 25, 2024
Updated: May 11, 2026
Reserved: Jun 20, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

media: lgdt3306a: Add a check against null-pointer-def

The driver should check whether the client provides the platform_data.

The following log reveals it:

[ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4f75189024f4186a7ff9d56f4a8cb690774412ec to before 8915dcd29a82096acacf54364a8425363782aea0Affected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before b479fd59a1f4a342b69fce34f222d93bf791dca4Affected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before 526238d32c3acc3d597fd8c9a34652bfe9086ceaAffected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before d082757b8359201c3864323cea4b91ea30a1e676Affected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before 7d12e918f2994c883f41f22552a61b9310fa1e87Affected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before 8e1e00718d0d9dd83337300572561e30b9c0d115Affected 4f75189024f4186a7ff9d56f4a8cb690774412ec to before c1115ddbda9c930fba0fdd062e7a8873ebaf898dAffected
LinuxLinux	4.11Affected before 4.11Not affected 5.4.278 through 5.4.Not affected 5.10.219 through 5.10.Not affected 5.15.161 through 5.15.Not affected 6.1.94 through 6.1.Not affected 6.6.34 through 6.6.Not affected 6.9.5 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

4f75189024f4186a7ff9d56f4a8cb690774412ec to before 8915dcd29a82096acacf54364a8425363782aea0Affected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before b479fd59a1f4a342b69fce34f222d93bf791dca4Affected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before 526238d32c3acc3d597fd8c9a34652bfe9086ceaAffected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before d082757b8359201c3864323cea4b91ea30a1e676Affected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before 7d12e918f2994c883f41f22552a61b9310fa1e87Affected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before 8e1e00718d0d9dd83337300572561e30b9c0d115Affected
4f75189024f4186a7ff9d56f4a8cb690774412ec to before c1115ddbda9c930fba0fdd062e7a8873ebaf898dAffected

LinuxLinux

4.11Affected
before 4.11Not affected
5.4.278 through 5.4.*Not affected
5.10.219 through 5.10.*Not affected
5.15.161 through 5.15.*Not affected
6.1.94 through 6.1.*Not affected
6.6.34 through 6.6.*Not affected
6.9.5 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.