CVE-2024-42313

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= af2c3834c8ca7cc65d15592ac671933df8848115 < ad8cf035baf29467158e0550c7a42b7bb43d1db6, >= af2c3834c8ca7cc65d15592ac671933df8848115 < 72aff311194c8ceda934f24fd6f250b8827d7567, >= af2c3834c8ca7cc65d15592ac671933df8848115 < 4c9d235630d35db762b85a4149bbb0be9d504c36, >= af2c3834c8ca7cc65d15592ac671933df8848115 < f8e9a63b982a8345470c225679af4ba86e4a7282, >= af2c3834c8ca7cc65d15592ac671933df8848115 < da55685247f409bf7f976cc66ba2104df75d8dad, >= af2c3834c8ca7cc65d15592ac671933df8848115 < 66fa52edd32cdbb675f0803b3c4da10ea19b6635, >= af2c3834c8ca7cc65d15592ac671933df8848115 < 6a96041659e834dc0b172dda4b2df512d63920c2, >= af2c3834c8ca7cc65d15592ac671933df8848115 < a0157b5aa34eb43ec4c5510f9c260bbb03be937e, >= 4.13, >= 4.13 < 4.19.320, >= 4.20 < 5.4.282, >= 5.5 < 5.10.224, >= 5.11 < 5.15.165, >= 5.16 < 6.1.103, >= 6.2 < 6.6.44, >= 6.7 < 6.10.3

Fixed versions

4.19.320, 5.4.282, 5.10.224, 5.15.165, 6.1.103, 6.6.44, 6.10.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416