In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov02a10: fix endpoint parsing use-after-free
The ov02a10_check_hwcfg() function calls fwnode_handle_put(ep)
immediately after allocating and parsing the endpoint. However, it
subsequently calls fwnode_property_read_u32() using the same 'ep'
handle, leading to a potential use-after-free.
Additionally, reading the optional 'ovti,mipi-clock-voltage' property
used to overwrite the 'ret' variable. If the property was missing,
'ret' would become negative, and this failure code would be incorrectly
returned at the end of the function, causing probe to fail entirely.
Fix the use-after-free by moving fwnode_property_read_u32() before
the endpoint is parsed and freed. Avoid the error leak by not
assigning the result of fwnode_property_read_u32() to 'ret'.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.
AC:L - After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.
PR:L - ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.
UI:N - The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.
S:U - The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.
C:H - fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode->ops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.
I:H - The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.
A:H - Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The use-after-free is in ov02a10_check_hwcfg() on the I2C probe path of the onboard OmniVision OV02A10 MIPI CSI-2 camera sensor (MediaTek phones, IoT cameras). It is reached only via local driver bind (boot, module load, or sysfs), not via network packets, Bluetooth/Wi-Fi, or USB.
AC:L - After v4l2_fwnode_endpoint_alloc_parse() succeeds, fwnode_handle_put(ep) is immediately followed by fwnode_property_read_u32(ep) on every probe with no race or attacker-uncontrollable layout. A local attacker who rebinds the driver or is present for boot/deferred probe triggers it reliably.
PR:L - ov02a10_probe() runs automatically at boot on DT-described OV02A10 cameras with no capable() check; sysfs bind is 0200, but CNA practice scores ambiguous probe/bind gating as Low rather than init-namespace root. An unprivileged local user on the phone or kiosk is sufficient.
UI:N - The dangling endpoint fwnode is consumed inside driver probe itself. No victim must open /dev/v4l-subdev*, mount a filesystem, or plug in hardware.
S:U - The fwnode/device_node use-after-free corrupts host-kernel heap within the same security authority. This is standard in-kernel memory corruption, not a VM escape, IOMMU/DMA bypass, or sandbox breakout.
C:H - fwnode_property_read_u32() calls fwnode_call_int_op(), which reads fwnode->ops from the endpoint after its reference was dropped. On dynamic OF overlay or software-node graphs that free on last put, that slab use-after-free read is Confidentiality High per UAF guidance.
I:H - The same dangling fwnode_handle.ops is dispatched as property_read_int_array(); reclaiming the freed node with a forged ops table yields an indirect call and control-flow hijack. Kernel guidance scores use-after-free as Integrity High.
A:H - Dispatch through a freed fwnode ops pointer oopses or panics the kernel during camera probe on affected phones and embedded devices. Any use-after-free is Availability High even when not fully exploited.
CVSS 3.1