CVE-2023-52491

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52491
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52491.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-52491
Downstream
Related
Published
2024-03-11T18:15:16Z
Modified
2025-08-09T20:01:27Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun

In mtkjpegprobe, &jpeg->jobtimeoutwork is bound with mtkjpegjobtimeoutwork.

In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it will finally start the worker while mark the job as finished by invoking v4l2m2mjob_finish.

There are two methods to trigger the bug. If we remove the module, it which will call mtkjpegremove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug.

CPU0 CPU1 mtkjpegdec... | start worker | |mtkjpegjobtimeoutwork mtkjpegremove | v4l2m2mrelease | kfree(m2mdev); | | | v4l2m2mgetcurrpriv | m2mdev->currctx //use

If we close the file descriptor, which will call mtkjpegrelease, it will have a similar sequence.

Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2m2mjobfinish will only be called in either mtkjpegjobtimeoutwork or mtkjpegdecdevice_run.

References

Affected packages