In the Linux kernel, the following vulnerability has been resolved:
media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun
In mtkjpegprobe, &jpeg->jobtimeoutwork is bound with mtkjpegjobtimeoutwork.
In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it will finally start the worker while mark the job as finished by invoking v4l2m2mjob_finish.
There are two methods to trigger the bug. If we remove the module, it which will call mtkjpegremove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug.
CPU0 CPU1 mtkjpegdec... | start worker | |mtkjpegjobtimeoutwork mtkjpegremove | v4l2m2mrelease | kfree(m2mdev); | | | v4l2m2mgetcurrpriv | m2mdev->currctx //use
If we close the file descriptor, which will call mtkjpegrelease, it will have a similar sequence.
Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2m2mjobfinish will only be called in either mtkjpegjobtimeoutwork or mtkjpegdecdevice_run.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fec4db7fff54d9b0306a332bab31eac47eeb5f6",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-0e1fca14",
"digest": {
"function_hash": "38867384191934470127328225688672835467",
"length": 1181.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9fec4db7fff54d9b0306a332bab31eac47eeb5f6",
"target": {
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-165929fb",
"digest": {
"line_hashes": [
"315619777106773653737861000167102013467",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8254d54d00eb6cdb8367399c7f912eb8d354ecd7",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-8746d6ae",
"digest": {
"function_hash": "220395666578869389124620652886803565067",
"length": 1198.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2f37022f0fc0893da4d85a0500c9d547fffd4c",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-8cf8c92f",
"digest": {
"function_hash": "220395666578869389124620652886803565067",
"length": 1198.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8254d54d00eb6cdb8367399c7f912eb8d354ecd7",
"target": {
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-9305cccf",
"digest": {
"line_hashes": [
"315619777106773653737861000167102013467",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2f37022f0fc0893da4d85a0500c9d547fffd4c",
"target": {
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-a9cb0396",
"digest": {
"line_hashes": [
"315619777106773653737861000167102013467",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43872f44eee6c6781fea1348b38885d8e78face9",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-ab1d78d7",
"digest": {
"function_hash": "38867384191934470127328225688672835467",
"length": 1181.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@206c857dd17d4d026de85866f1b5f0969f2a109e",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-bc835ddf",
"digest": {
"function_hash": "220395666578869389124620652886803565067",
"length": 1198.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b1036c60a37a30caf6759a90fe5ecd06ec35590",
"target": {
"file": "drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-c457cb18",
"digest": {
"line_hashes": [
"315619777106773653737861000167102013467",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b1036c60a37a30caf6759a90fe5ecd06ec35590",
"target": {
"function": "mtk_jpeg_dec_device_run",
"file": "drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-d13176ee",
"digest": {
"function_hash": "38867384191934470127328225688672835467",
"length": 1181.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@43872f44eee6c6781fea1348b38885d8e78face9",
"target": {
"file": "drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-e9e809eb",
"digest": {
"line_hashes": [
"953916744185907045835811524012308140",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@206c857dd17d4d026de85866f1b5f0969f2a109e",
"target": {
"file": "drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52491-f7d4df29",
"digest": {
"line_hashes": [
"315619777106773653737861000167102013467",
"285611202888644739238132283014793862221",
"25417094729557666345343837676949020699",
"215127019455459325022012068270754405755",
"173703582429113304010401368334399131162",
"290338737494854026388554562023901942144",
"284807882695484142232898157848515507583",
"63167053640244605104868979544423833688"
],
"threshold": 0.9
}
}
]