| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run\n\nIn mtk_jpeg_probe, &jpeg->job_timeout_work is bound with\nmtk_jpeg_job_timeout_work.\n\nIn mtk_jpeg_dec_device_run, if error happens in\nmtk_jpeg_set_dec_dst, it will finally start the worker while\nmark the job as finished by invoking v4l2_m2m_job_finish.\n\nThere are two methods to trigger the bug. If we remove the\nmodule, it which will call mtk_jpeg_remove to make cleanup.\nThe possible sequence is as follows, which will cause a\nuse-after-free bug.\n\nCPU0 CPU1\nmtk_jpeg_dec_... |\n start worker\t |\n |mtk_jpeg_job_timeout_work\nmtk_jpeg_remove |\n v4l2_m2m_release |\n kfree(m2m_dev); |\n |\n | v4l2_m2m_get_curr_priv\n | m2m_dev->curr_ctx //use\n\nIf we close the file descriptor, which will call mtk_jpeg_release,\nit will have a similar sequence.\n\nFix this bug by starting timeout worker only if started jpegdec worker\nsuccessfully. Then v4l2_m2m_job_finish will only be called in\neither mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c" |
| ], |
| "versions": [ |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "43872f44eee6c6781fea1348b38885d8e78face9", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "1b1036c60a37a30caf6759a90fe5ecd06ec35590", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "9fec4db7fff54d9b0306a332bab31eac47eeb5f6", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "8254d54d00eb6cdb8367399c7f912eb8d354ecd7", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "6e2f37022f0fc0893da4d85a0500c9d547fffd4c", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b2f0d2724ba477d326e9d654d4db1c93e98f8b93", |
| "lessThan": "206c857dd17d4d026de85866f1b5f0969f2a109e", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c" |
| ], |
| "versions": [ |
| { |
| "version": "4.12", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "4.12", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.210", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.149", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.76", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.15", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.7.3", |
| "lessThanOrEqual": "6.7.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.8", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "5.10.210" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "5.15.149" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.1.76" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.6.15" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.7.3" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.8" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e" |
| } |
| ], |
| "title": "media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2023-52491", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
