CVE-2023-52764

media: gspca: cpia1: shift-out-of-bounds in set_flicker

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

media: gspca: cpia1: shift-out-of-bounds in set_flicker

Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'

When the value of the variable "sd->params.exposure.gain" exceeds the
number of bits in an integer, a shift-out-of-bounds error is reported. It
is triggered because the variable "currentexp" cannot be left-shifted by
more than the number of bits in an integer. In order to avoid invalid
range during left-shift, the conditional expression is added.

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: media: gspca: cpia1: desplazamiento fuera de los límites en set_flicker. Syzkaller informó el siguiente problema: UBSAN: desplazamiento fuera de los límites en drivers/media/usb/gspca /cpia1.c:1031:27 el exponente de desplazamiento 245 es demasiado grande para el tipo 'int' de 32 bits. Cuando el valor de la variable "sd->params.exposure.gain" excede el número de bits en un número entero, se realiza un desplazamiento. Se informa un error fuera de los límites. Se activa porque la variable "currentexp" no puede desplazarse hacia la izquierda más que el número de bits de un número entero. Para evitar un rango no válido durante el desplazamiento a la izquierda, se agrega la expresión condicional.

*Credits: N/A

CVSS Scores

Red Hatv3.1 4.4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-05-21 CVE Reserved
2024-05-21 CVE Published
2024-05-22 EPSS Updated
2024-09-11 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-125: Out-of-bounds Read

CAPEC

References (11)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/69bba62600bd91d6b7c1e8ca181faf8ac64f7060	2023-11-28
https://git.kernel.org/stable/c/2eee8edfff90e22980a6b22079d238c3c9d323bb	2023-11-28
https://git.kernel.org/stable/c/8f83c85ee88225319c52680792320c02158c2a9b	2023-11-28
https://git.kernel.org/stable/c/c6b6b8692218da73b33b310d7c1df90f115bdd9a	2023-11-28
https://git.kernel.org/stable/c/09cd8b561aa9796903710a1046957f2b112c8f26	2023-11-28
https://git.kernel.org/stable/c/a647f27a7426d2fe1b40da7c8fa2b81354a51177	2023-11-28
https://git.kernel.org/stable/c/93bddd6529f187f510eec759f37d0569243c9809	2023-11-28
https://git.kernel.org/stable/c/e2d7149b913d14352c82624e723ce1c211ca06d3	2023-11-28
https://git.kernel.org/stable/c/099be1822d1f095433f4b08af9cc9d6308ec1953	2023-09-27

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2023-52764	2024-08-08
https://bugzilla.redhat.com/show_bug.cgi?id=2282780	2024-08-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.14.331 Search vendor "Linux" for product "Linux Kernel" and version " < 4.14.331"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 4.19.300 Search vendor "Linux" for product "Linux Kernel" and version " < 4.19.300"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.4.262 Search vendor "Linux" for product "Linux Kernel" and version " < 5.4.262"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.10.202 Search vendor "Linux" for product "Linux Kernel" and version " < 5.10.202"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 5.15.140 Search vendor "Linux" for product "Linux Kernel" and version " < 5.15.140"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.64 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.64"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.5.13 Search vendor "Linux" for product "Linux Kernel" and version " < 6.5.13"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.3 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.3"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.7 Search vendor "Linux" for product "Linux Kernel" and version " < 6.7"		en		Affected