Linux Kernel Vidtv Driver NULL Pointer Dereference Vulnerability

A NULL pointer dereference vulnerability has been identified in the Linux kernel's Vidtv driver. This issue arises in the 'vidtv_mux_push_si' function, where the 'vidtv_mux_get_pid_ctx' call can return NULL. The function fails to check for this before accessing the continuity counter, leading to a general protection fault by dereferencing a near-NULL address. The vulnerability is rooted in the 'vidtv_mux_pid_ctx_init' function, which does not properly verify the return value of 'vidtv_mux_create_pid_ctx_once' for PMT section PIDs. If the allocation fails, the PID context is not created, yet the function indicates success. Consequently, the 'vidtv_mux_push_si' call receives NULL and crashes.

Impact

Exploitation of this vulnerability causes a general protection fault, likely due to a non-canonical address access, which crashes the system.

Reproduction

The vulnerability can be reproduced by triggering the 'vidtv_mux_push_si' function without a valid PID context, which can occur if the 'vidtv_mux_pid_ctx_init' function fails to create the context for PMT section PIDs but still returns a success status. This can be done by simulating a failure in the PID context allocation process.

Remediation

The vulnerability has been addressed by adding error checks in the 'vidtv_mux_pid_ctx_init' function for PMT PIDs and by incorporating defensive NULL checks in 'vidtv_mux_push_si' for all calls to 'vidtv_mux_get_pid_ctx'.