CVE-2023-52491: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun
In mtkjpegprobe, &jpeg->jobtimeoutwork is bound with mtkjpegjobtimeoutwork.
In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it will finally start the worker while mark the job as finished by invoking v4l2m2mjobfinish.
There are two methods to trigger the bug. If we remove the module, it which will call mtkjpegremove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug.
CPU0 CPU1 mtkjpegdec... | start worker | |mtkjpegjobtimeoutwork mtkjpegremove | v4l2m2mrelease | kfree(m2mdev); | | | v4l2m2mgetcurrpriv | m2mdev->currctx //use
If we close the file descriptor, which will call mtkjpegrelease, it will have a similar sequence.
Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2m2mjobfinish will only be called in either mtkjpegjobtimeoutwork or mtkjpegdecdevicerun.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52491?
CVE-2023-52491 has a severity rating that depends on its exploitation context and the specific Linux kernel version in use.
How do I fix CVE-2023-52491?
You can fix CVE-2023-52491 by updating to the recommended versions, such as 5.10.223-1, 6.1.123-1, or 6.12.11-1 and higher.
Which versions of the Linux kernel are affected by CVE-2023-52491?
CVE-2023-52491 affects various versions of the Linux kernel, specifically those ranging from 4.12 to 6.7.
What is the nature of the vulnerability in CVE-2023-52491?
CVE-2023-52491 is a use-after-free vulnerability resulting from improper error path handling in the mtk_jpeg_dec_device_run function.
Who is responsible for addressing CVE-2023-52491?
The maintainers of the Linux kernel are responsible for addressing CVE-2023-52491 by releasing patches and updates.