Bug 1220939 (CVE-2023-52565)

Summary:	VUL-0: CVE-2023-52565: kernel: media: uvcvideo: Fix OOB read
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	gabriele.sonnu, osalvador
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/396088/
Whiteboard:	CVSSv3.1:SUSE:CVE-2023-52565:5.5:(AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-03-05 09:21:03 UTC

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Fix OOB read

If the index provided by the user is bigger than the mask size, we might do
an out of bound read.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52565
https://www.cve.org/CVERecord?id=CVE-2023-52565
https://git.kernel.org/stable/c/09635bf4cdd4adf2160198a6041bcc7ca46c0558
https://git.kernel.org/stable/c/41ebaa5e0eebea4c3bac96b72f9f8ae0d77c0bdb
https://git.kernel.org/stable/c/8bcf70d787f7d53a3b85ad394f926cfef3eed023
https://bugzilla.redhat.com/show_bug.cgi?id=2267724

Comment 1 Gabriele Sonnu 2024-03-05 13:46:01 UTC

Affected branches already contain the fix. @kernel-team, please add the CVE reference.

Comment 10 Oscar Salvador 2024-04-15 20:37:42 UTC

References already updated.
Back to sec-team.

Comment 17 Andrea Mattiazzo 2024-06-12 07:37:44 UTC

All done, closing.