CVE-2023-52847

media: bttv: fix use after free error due to btv->timeout timer

State: Published
Severity: 7.8 High
Published: May 21, 2024
Updated: Aug 5, 2026
Reserved: May 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

media: bttv: fix use after free error due to btv->timeout timer

There may be some a race condition between timer function bttv_irq_timeout and bttv_remove. The timer is setup in probe and there is no timer_delete operation in remove function. When it hit kfree btv, the function might still be invoked, which will cause use after free bug.

This bug is found by static analysis, it may be false positive.

Fix it by adding del_timer_sync invoking to the remove function.

cpu0 cpu1 bttv_probe ->timer_setup ->bttv_set_dma ->mod_timer; bttv_remove ->kfree(btv); ->bttv_irq_timeout ->USE btv

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9Affected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before b35fdade92c5058a5e727e233fe263b828de2c9aAffected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 2f3d9198cdae1cb079ec8652f4defacd481eab2bAffected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 51c94256a83fe4e17406c66ff3e1ad7d242d8574Affected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 20568d06f6069cb835e05eed432edf962645d226Affected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 1871014d6ef4812ad11ef7d838d73ce09d632267Affected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 847599fffa528b2cdec4e21b6bf7586dad982132Affected 162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before bd5b50b329e850d467e7bcc07b2b6bde3752fbdaAffected
LinuxLinux	4.15Affected before 4.15Not affected 4.19.299 through 4.19.Not affected 5.4.261 through 5.4.Not affected 5.10.201 through 5.10.Not affected 5.15.139 through 5.15.Not affected 6.1.63 through 6.1.Not affected 6.5.12 through 6.5.Not affected 6.6.2 through 6.6.*Not affected 6.7 and laterNot affected

Product

Versions

LinuxLinux

162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before bbc3b8dd2cb7817e703f112d988e4f4728f0f2a9Affected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before b35fdade92c5058a5e727e233fe263b828de2c9aAffected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 2f3d9198cdae1cb079ec8652f4defacd481eab2bAffected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 51c94256a83fe4e17406c66ff3e1ad7d242d8574Affected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 20568d06f6069cb835e05eed432edf962645d226Affected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 1871014d6ef4812ad11ef7d838d73ce09d632267Affected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before 847599fffa528b2cdec4e21b6bf7586dad982132Affected
162e6376ac58440beb6a2d2ee294f5d88ea58dd1 to before bd5b50b329e850d467e7bcc07b2b6bde3752fbdaAffected

LinuxLinux

4.15Affected
before 4.15Not affected
4.19.299 through 4.19.*Not affected
5.4.261 through 5.4.*Not affected
5.10.201 through 5.10.*Not affected
5.15.139 through 5.15.*Not affected
6.1.63 through 6.1.*Not affected
6.5.12 through 6.5.*Not affected
6.6.2 through 6.6.*Not affected
6.7 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.