High · published August 17, 2024
In the Linux kernel, the following vulnerability has been resolved:
media: venus: fix use after free in vdec_close
There appears to be a possible use after free with vdec_close().
The firmware will add buffer release work to the work queue through
HFI callbacks as a normal part of decoding. Randomly closing the
decoder device from userspace during normal decoding can incur
a read after free for inst.
Fix it by cancelling the work in vdec_close.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.13, < 4.19.320 | 4.19.320 |
| linux/linux_kernel | ≥ 4.20, < 5.4.282 | 5.4.282 |
| linux/linux_kernel | ≥ 5.5, < 5.10.224 | 5.10.224 |
| linux/linux_kernel | ≥ 5.11, < 5.15.165 | 5.15.165 |
| linux/linux_kernel | ≥ 5.16, < 6.1.103 | 6.1.103 |
| linux/linux_kernel | ≥ 6.2, < 6.6.44 | 6.6.44 |
| linux/linux_kernel | ≥ 6.7, < 6.10.3 | 6.10.3 |