CVE-2023-52491

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-52491
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2_m2m_job_finish will only be called in either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 Patch
https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e Patch
https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 Patch
https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c Patch
https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 Patch
https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 Patch
https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 Patch
https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e Patch
https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 Patch
https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c Patch
https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 Patch
https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Dec 2024, 17:32

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 - () https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 - Patch
References () https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e - () https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e - Patch
References () https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 - () https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 - Patch
References () https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c - () https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c - Patch
References () https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 - () https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 - Patch
References () https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 - () https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Patch

21 Nov 2024, 08:39

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 - () https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 -
References () https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e - () https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e -
References () https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 - () https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 -
References () https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c - () https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c -
References () https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 - () https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 -
References () https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 - () https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 -

04 Nov 2024, 13:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

25 Jun 2024, 21:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: medio: mtk-jpeg: Se corrigió el error de use-after-free debido al manejo de la ruta de error en mtk_jpeg_dec_device_run En mtk_jpeg_probe, &jpeg->job_timeout_work está vinculado con mtk_jpeg_job_timeout_work. En mtk_jpeg_dec_device_run, si ocurre un error en mtk_jpeg_set_dec_dst, finalmente iniciará el trabajador mientras marca el trabajo como finalizado invocando v4l2_m2m_job_finish. Hay dos métodos para activar el error. Si eliminamos el módulo, llamará a mtk_jpeg_remove para realizar la limpieza. La secuencia posible es la siguiente, lo que provocará un error de use-after-free. CPU0 CPU1 mtk_jpeg_dec_... | empezar trabajador | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use Si cerramos el descriptor de archivo, que llamará a mtk_jpeg_release, tendrá una secuencia similar. Corrija este error iniciando el trabajador de tiempo de espera solo si inició el trabajador jpegdec exitosamente. Entonces v4l2_m2m_job_finish solo se llamará en mtk_jpeg_job_timeout_work o mtk_jpeg_dec_device_run.

11 Mar 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-11 18:15

Updated : 2024-12-12 17:32

NVD link : CVE-2023-52491

Mitre link : CVE-2023-52491

CVE.ORG link : CVE-2023-52491

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free