CVE-2024-42313

media: venus: fix use after free in vdec_close

State: Published
Severity: 7.8 High
Published: Aug 17, 2024
Updated: Aug 5, 2026
Reserved: Jul 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

media: venus: fix use after free in vdec_close

There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst.

Fix it by cancelling the work in vdec_close.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	af2c3834c8ca7cc65d15592ac671933df8848115 to before ad8cf035baf29467158e0550c7a42b7bb43d1db6Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before 72aff311194c8ceda934f24fd6f250b8827d7567Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before 4c9d235630d35db762b85a4149bbb0be9d504c36Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before f8e9a63b982a8345470c225679af4ba86e4a7282Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before da55685247f409bf7f976cc66ba2104df75d8dadAffected af2c3834c8ca7cc65d15592ac671933df8848115 to before 66fa52edd32cdbb675f0803b3c4da10ea19b6635Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before 6a96041659e834dc0b172dda4b2df512d63920c2Affected af2c3834c8ca7cc65d15592ac671933df8848115 to before a0157b5aa34eb43ec4c5510f9c260bbb03be937eAffected
LinuxLinux	4.13Affected before 4.13Not affected 4.19.320 through 4.19.Not affected 5.4.282 through 5.4.Not affected 5.10.224 through 5.10.Not affected 5.15.165 through 5.15.Not affected 6.1.103 through 6.1.Not affected 6.6.44 through 6.6.Not affected 6.10.3 through 6.10.*Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

af2c3834c8ca7cc65d15592ac671933df8848115 to before ad8cf035baf29467158e0550c7a42b7bb43d1db6Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before 72aff311194c8ceda934f24fd6f250b8827d7567Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before 4c9d235630d35db762b85a4149bbb0be9d504c36Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before f8e9a63b982a8345470c225679af4ba86e4a7282Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before da55685247f409bf7f976cc66ba2104df75d8dadAffected
af2c3834c8ca7cc65d15592ac671933df8848115 to before 66fa52edd32cdbb675f0803b3c4da10ea19b6635Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before 6a96041659e834dc0b172dda4b2df512d63920c2Affected
af2c3834c8ca7cc65d15592ac671933df8848115 to before a0157b5aa34eb43ec4c5510f9c260bbb03be937eAffected

LinuxLinux

4.13Affected
before 4.13Not affected
4.19.320 through 4.19.*Not affected
5.4.282 through 5.4.*Not affected
5.10.224 through 5.10.*Not affected
5.15.165 through 5.15.*Not affected
6.1.103 through 6.1.*Not affected
6.6.44 through 6.6.*Not affected
6.10.3 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.