CVE-2024-39481: media: mc: Fix graph walk in media_pipeline_start
In the Linux kernel, the following vulnerability has been resolved:
media: mc: Fix graph walk in mediapipelinestart
The graph walk tries to follow all links, even if they are not between pads. This causes a crash with, e.g. a MEDIALNKFLANCILLARYLINK link.
Fix this by allowing the walk to proceed only for MEDIALNKFLDATALINK links.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Update the graph walk logic in media_pipeline_start to follow only links of type MEDIA_LNK_FL_DATA_LINK, and not other media links (e.g., prevent following MEDIA_LNK_FL_ANCILLARY_LINK).
Linux kernel media/mc (media_pipeline_start graph walk) link filtering = allow walk to proceed only for MEDIA_LNK_FL_DATA_LINK links
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39481?
CVE-2024-39481 is categorized as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-39481?
To resolve CVE-2024-39481, update your Linux kernel to a version that includes the fix, such as 5.10.223-1 or later.
Which Linux kernel versions are affected by CVE-2024-39481?
CVE-2024-39481 affects Linux kernel versions between 6.1 and 6.1.94, 6.6 and 6.6.34, as well as 6.9 and 6.9.5.
What type of issue does CVE-2024-39481 address in the Linux kernel?
CVE-2024-39481 addresses a graph walk issue in the media pipeline, which can result in a crash.
Is there a specific package version to upgrade for CVE-2024-39481?
Yes, users should upgrade to specific Debian packages like linux version 5.10.223-1 or 6.12.10-1 to fix CVE-2024-39481.