In the Linux kernel, the following vulnerability has been resolved:
media: venus: fix use after free in vdec_close
There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst.
Fix it by cancelling the work in vdec_close.
[
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-0468e90b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8e9a63b982a8345470c225679af4ba86e4a7282",
"signature_version": "v1",
"digest": {
"function_hash": "193796984509656245996244605372297642741",
"length": 335.0
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-1147fd32",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad8cf035baf29467158e0550c7a42b7bb43d1db6",
"signature_version": "v1",
"digest": {
"function_hash": "163257356221538917782653496827989070618",
"length": 327.0
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-170b763a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da55685247f409bf7f976cc66ba2104df75d8dad",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-3055fcfa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0157b5aa34eb43ec4c5510f9c260bbb03be937e",
"signature_version": "v1",
"digest": {
"function_hash": "179084455669136223050486644868117538172",
"length": 402.0
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-311f4915",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f8e9a63b982a8345470c225679af4ba86e4a7282",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-6efdc421",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad8cf035baf29467158e0550c7a42b7bb43d1db6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"291653812896078951439318544589401752895",
"85259889289692866111890843687566640357",
"81630763332224218754560555004558705535"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-7bd51094",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0157b5aa34eb43ec4c5510f9c260bbb03be937e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-7f9fcdf7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72aff311194c8ceda934f24fd6f250b8827d7567",
"signature_version": "v1",
"digest": {
"function_hash": "163257356221538917782653496827989070618",
"length": 327.0
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-9782ad89",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da55685247f409bf7f976cc66ba2104df75d8dad",
"signature_version": "v1",
"digest": {
"function_hash": "193547023326172905511880341965477107574",
"length": 367.0
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-b6b9f5db",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66fa52edd32cdbb675f0803b3c4da10ea19b6635",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-cd303dbe",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a96041659e834dc0b172dda4b2df512d63920c2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-dac58a88",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c9d235630d35db762b85a4149bbb0be9d504c36",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"165020632443714315571128081680484450971",
"117810175668760060300321231295053480929",
"162215661392239473351420436401561603763"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-dbab569f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a96041659e834dc0b172dda4b2df512d63920c2",
"signature_version": "v1",
"digest": {
"function_hash": "179084455669136223050486644868117538172",
"length": 402.0
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-dca5eb51",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4c9d235630d35db762b85a4149bbb0be9d504c36",
"signature_version": "v1",
"digest": {
"function_hash": "193796984509656245996244605372297642741",
"length": 335.0
},
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-eee2edc7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72aff311194c8ceda934f24fd6f250b8827d7567",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"291653812896078951439318544589401752895",
"85259889289692866111890843687566640357",
"81630763332224218754560555004558705535"
]
},
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "vdec_close",
"file": "drivers/media/platform/qcom/venus/vdec.c"
},
"id": "CVE-2024-42313-f5065bb6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@66fa52edd32cdbb675f0803b3c4da10ea19b6635",
"signature_version": "v1",
"digest": {
"function_hash": "179084455669136223050486644868117538172",
"length": 402.0
},
"deprecated": false
}
]