media: atomisp: Add check for rgby_data memory allocation failure (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.27 % · percentile 19 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not successfully allocated, it may trigger the assert(host_stats->rgby_data) assertion in ia_css_s3a_hmem_decode(). Adding a check to fix this potential issue.
Weaknesses (CWE)
- CWE-617 — Reachable Assertion
References
- https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
- https://git.kernel.org/stable/c/0c24b82bc4d12c6a58ceacbf2598cd4df63abf9a
- https://git.kernel.org/stable/c/4676e50444046b498555b849e6080a5c78cdda9b
- https://git.kernel.org/stable/c/02a97d9d7ff605fa4a1f908d1bd3ad8573234b61
- https://git.kernel.org/stable/c/8066badaf7463194473fb4be19dbe50b11969aa0
- https://git.kernel.org/stable/c/74aa783682c4d78c69d87898e40c78df1fec204e
- https://git.kernel.org/stable/c/0c25ab93f2878cab07d37ca5afd302283201e5af
- https://git.kernel.org/stable/c/ed61c59139509f76d3592683c90dc3fdc6e23cd6
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-53353
- GCVE · GCVE-0-2024-56705
CERT-FR advisories
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0308 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0185 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0184 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0152 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0151 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0133 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0088 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.12 < 4.18cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.8 < 5.10.231cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.174cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.120cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.64cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.11.11cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12 < 6.12.2cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected a49d25364dfb9f8a64037488a39ab1f56c5fa419 < 51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654 ; affected ad85094b293e40e7a2f831b0311a389d952ebd5e < 0c24b82bc4d12c6a58ceacbf2598cd4df63abf9a ; affected ad85094b293e40e7a2f831b0311a389d952ebd5e < 4676e50444046b498555b849e6080a5c78cdda9b ; affected ad85094b293e40e7a2f831b0311a389d952ebd5e < 02a97d9d7ff605fa4a1f908d1bd3ad8573234b61 ; affected ad85094b293e40e7a2f831b0311a389d952ebd5e < 8066badaf7463194473fb4be19dbe50b11969aa0 ; affected ad85094b293e40e7a2f831b0311a389d952ebd5e < 74aa783682c4d78c69d87898e40c78df1fec204e |
| Linux · Linux | affected 4.12 ; affected 5.8 ; unaffected 0 < 4.12 ; unaffected 4.18 < 5.8 ; unaffected 5.10.231 ≤ 5.10.* ; unaffected 5.15.174 ≤ 5.15.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |