cve/published/2023/CVE-2023-52491.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2023-52491: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with
mtk_jpeg_job_timeout_work.

In mtk_jpeg_dec_device_run, if error happens in
mtk_jpeg_set_dec_dst, it will finally start the worker while
mark the job as finished by invoking v4l2_m2m_job_finish.

There are two methods to trigger the bug. If we remove the
module, it which will call mtk_jpeg_remove to make cleanup.
The possible sequence is as follows, which will cause a
use-after-free bug.

CPU0                  CPU1
mtk_jpeg_dec_...    |
  start worker	    |
                    |mtk_jpeg_job_timeout_work
mtk_jpeg_remove     |
  v4l2_m2m_release  |
    kfree(m2m_dev); |
                    |
                    | v4l2_m2m_get_curr_priv
                    |   m2m_dev->curr_ctx //use

If we close the file descriptor, which will call mtk_jpeg_release,
it will have a similar sequence.

Fix this bug by starting timeout worker only if started jpegdec worker
successfully. Then v4l2_m2m_job_finish will only be called in
either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run.

The Linux kernel CVE team has assigned CVE-2023-52491 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 5.10.210 with commit 43872f44eee6c6781fea1348b38885d8e78face9
	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 5.15.149 with commit 1b1036c60a37a30caf6759a90fe5ecd06ec35590
	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 6.1.76 with commit 9fec4db7fff54d9b0306a332bab31eac47eeb5f6
	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 6.6.15 with commit 8254d54d00eb6cdb8367399c7f912eb8d354ecd7
	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 6.7.3 with commit 6e2f37022f0fc0893da4d85a0500c9d547fffd4c
	Issue introduced in 4.12 with commit b2f0d2724ba477d326e9d654d4db1c93e98f8b93 and fixed in 6.8 with commit 206c857dd17d4d026de85866f1b5f0969f2a109e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52491
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9
	https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590
	https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6
	https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7
	https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c
	https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e