CVE-2024-56577: media: mtk-jpeg: Fix null-ptr-deref during unload module
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-jpeg: Fix null-ptr-deref during unload module
The workqueue should be destroyed in mtkjpegcore.c since commit 09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise the below calltrace can be easily triggered.
[ 677.862514] Unable to handle kernel paging request at virtual address dfff800000000023 [ 677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] ... [ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O 6.8.12-mtk+gfa1a78e5d24b+ #17 ... [ 677.882838] pc : destroyworkqueue+0x3c/0x770 [ 677.883413] lr : mtkjpegdecdestroyworkqueue+0x70/0x88 [mtkjpegdechw] [ 677.884314] sp : ffff80008ad974f0 [ 677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070 [ 677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690 [ 677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000 [ 677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0 [ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10 [ 677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d [ 677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90 [ 677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001 [ 677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000 [ 677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118 [ 677.893977] Call trace: [ 677.894297] destroyworkqueue+0x3c/0x770 [ 677.894826] mtkjpegdecdestroyworkqueue+0x70/0x88 [mtkjpegdechw] [ 677.895677] devmactionrelease+0x50/0x90 [ 677.896211] releasenodes+0xe8/0x170 [ 677.896688] devresreleaseall+0xf8/0x178 [ 677.897219] deviceunbindcleanup+0x24/0x170 [ 677.897785] devicereleasedriverinternal+0x35c/0x480 [ 677.898461] devicereleasedriver+0x20/0x38 ... [ 677.912665] ---[ end trace 0000000000000000 ]---
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56577?
CVE-2024-56577 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-56577?
To fix CVE-2024-56577, update your Linux kernel to a patched version, such as 5.10.223-1, 6.1.129-1, or later.
What software versions are affected by CVE-2024-56577?
CVE-2024-56577 affects Linux kernel versions between 6.4 and 6.6.64, and also versions between 6.7 and 6.12.4.
What does CVE-2024-56577 exploit?
CVE-2024-56577 exploits a null pointer dereference during module unloading in the mtk-jpeg subsystem of the Linux kernel.
Is CVE-2024-56577 fixed in the latest Linux kernel release?
Yes, CVE-2024-56577 is resolved in recent releases of the Linux kernel, including versions after the patched commits.