In the Linux kernel, the following vulnerability has been resolved:
media: venus: fix use after free bug in venus_remove due to race condition
in venusprobe, core->work is bound with venussyserrorhandler, which is used to handle error. The code use core->syserrdone to make sync work. The core->work is started in venuseventnotify.
If we call venus_remove, there might be an unfished work. The possible sequence is as follows:
CPU0 CPU1
|venus_sys_error_handler
venusremove | hfidestroy | venushfidestroy | kfree(hdev); | |hfireinit |venushfiqueuesreinit |//use hdev
Fix it by canceling the work in venus_remove.
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"322475467545539910065187797095549636181",
"300417750883971263352840512350035483542",
"144225455795002805788209515951661076372"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5098b9e6377577fe13d03e1d8914930f014a3314",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"id": "CVE-2024-49981-23543d6f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 525.0,
"function_hash": "317703858383521593026287299533889795234"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0686aedc5f1343442d044bd64eeac7e7a391f4e",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c",
"function": "venus_remove"
},
"id": "CVE-2024-49981-39345e3e"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"249881706033382388549090454370243512124",
"300417750883971263352840512350035483542",
"144225455795002805788209515951661076372"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"id": "CVE-2024-49981-5e98abd7"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 376.0,
"function_hash": "301893111459401609111001101401602193080"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63bbe26471ebdcc3c20bb4cc3950d666279ad658",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c",
"function": "venus_remove"
},
"id": "CVE-2024-49981-6f1da3a3"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"249881706033382388549090454370243512124",
"300417750883971263352840512350035483542",
"144225455795002805788209515951661076372"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0686aedc5f1343442d044bd64eeac7e7a391f4e",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"id": "CVE-2024-49981-7249882e"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 357.0,
"function_hash": "8927710135629233577452579142893175934"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5098b9e6377577fe13d03e1d8914930f014a3314",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c",
"function": "venus_remove"
},
"id": "CVE-2024-49981-9c9310ca"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 525.0,
"function_hash": "317703858383521593026287299533889795234"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d925e9f7fb5a2dbefd1a73fc01061f38c7becd4c",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c",
"function": "venus_remove"
},
"id": "CVE-2024-49981-a5bc3b46"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"322475467545539910065187797095549636181",
"300417750883971263352840512350035483542",
"144225455795002805788209515951661076372"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63bbe26471ebdcc3c20bb4cc3950d666279ad658",
"target": {
"file": "drivers/media/platform/qcom/venus/core.c"
},
"id": "CVE-2024-49981-ab82e9bf"
}
]