CVE-2022-49254

media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats()

Description

In the Linux kernel, the following vulnerability has been resolved: media: ti-vpe: cal: Fix a NULL pointer dereference in cal_ctx_v4l2_init_formats() In cal_ctx_v4l2_init_formats(), devm_kzalloc() is assigned to ctx->active_fmt and there is a dereference of it after that, which could lead to NULL pointer dereference on failure of devm_kzalloc(). Fix this bug by adding a NULL check of ctx->active_fmt. This bug was found by a static analyzer. Builds with 'make allyesconfig' show no new warnings, and our static analyzer no longer warns about this code.

N/A

CVSS

Severity:

EPSS 0.03%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/aa613ac270292e102503e9767882e39200efe608
https://git.kernel.org/stable/c/91e2805579ab0783eed53acc2bf9fb553e939004
https://git.kernel.org/stable/c/1381f1a629a090c251965edb56f849ad648414a4
https://git.kernel.org/stable/c/abd77889851d2ead0d0c9c4d29f1808801477b00

Frequently Asked Questions

What is the severity of CVE-2022-49254?: CVE-2022-49254 has not yet been assigned a CVSS score.
How to fix CVE-2022-49254?: To fix CVE-2022-49254, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49254 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-49254 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49254?: CVE-2022-49254 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.