Log in Start free

Vulnerability · Published May 19, 2024 · Assigned by Linux

CVE-2024-35921media: mediatek: vcodec: Fix oops when HEVC init fails

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 85.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed in case of a failure in the deinit function. Only store the instance pointer when the initialization was successful, to solve this issue. Hardware name: Acer Tomato (rev3 - 4) board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] sp : ffff80008750bc20 x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 Call trace: vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] v4l2_release+0x7c/0x100 __fput+0x80/0x2d8 __fput_sync+0x58/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xd8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 Code: d503201f f9401660 b900127f b900227f (f9400400)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.8.9-1DEBIAN-CVE-2024-35921
Debian:14linux6.8.9-1DEBIAN-CVE-2024-35921
Ubuntu:24.04:LTSlinux6.8.0-38.38UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-aws6.8.0-1011.12UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1011.12~22.04.1UBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-azure6.8.0-1010.10UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1010.10~22.04.1UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-gcp6.8.0-1010.11UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-gke6.8.0-1006.9UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-ibm6.8.0-1008.8UBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-intel6.8.0-1007.14UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-38.38.1UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1009.9UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1009.9~22.04.1UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1008.8UBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-oracle6.8.0-1008.8UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1008.8~22.04.1UBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-raspi6.8.0-1007.7UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-35921
Ubuntu:24.04:LTSlinux-riscv6.8.0-38.38.1UBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-35921
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-35921

Affected products (as reported)

VendorProductVersions
Linux Linux 2674486aac7d9c95ceb77daf7c30f862d4295c1c – before ec25fc3c2c1e8958a51abcfed614f81446d918c42674486aac7d9c95ceb77daf7c30f862d4295c1c – before 521ce0ea7418298d754494fe53263c23c4c78a8e2674486aac7d9c95ceb77daf7c30f862d4295c1c – before 97c75ee5de060d271d80109b0c47cb6008439e5b
Linux Linux 6.5

References