From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F33016064B for ; Thu, 29 Feb 2024 15:53:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709222000; cv=none; b=slioNhJbfjRvnX+Krdjx0SzIzjKxfNBEXPPdzIrDlyGxTFuDWJOkoFZwhIYWDSinjkkTUy5eBIIPSVrQ5U97mx75h3FIWC/X5fh+HK+IbFMi7Gx3n0rwz0QRS7nXyvM+jzTu+55AmOPNUDHRcykBbMlMzMfnS1oEI6ep9iavRQg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709222000; c=relaxed/simple; bh=LIOWkKuyoojmpK7TbIuB6Yb/ARauC1qmukZ5SeY0P00=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=J2tyK9kRVuZ8dobbmKAY+03rHe5ZF0kESkLV2Sw9G54tzRN+jNlmqbk+kI2r6kmgyWOgl7+TbVPdDneYcDizVjUEukzRzCGnufmQ1j4adUZmuFqnhTsmXp09o7qqFjOc1wxiCXLKsrM0CVULOGX1aX9wVx+ZKm4kaf6cNKVWr1o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XFfevZxw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XFfevZxw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18B90C433F1; Thu, 29 Feb 2024 15:53:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1709221999; bh=LIOWkKuyoojmpK7TbIuB6Yb/ARauC1qmukZ5SeY0P00=; h=From:To:Cc:Subject:Date:Reply-to:From; b=XFfevZxwkp+iXiRaZG6QB9NrzBaAWJZkdPgDuseXyd3b3vsmbla/S3y11sHTdTv0u WzHkwbvSUwScZgHM/k92hhZpEYwtjKkuR/QTGltBKI0jDPTYnpFJSVpWvmYVw5k8mO e4/ow8Ayx4aqdh1Z7FmiKWtXV/dMcMIQa1dTv+gTTTyQvza5isTXpojNiR/46qarYV KaLaIPY02qb1KujRIKPUqxtX6GthVdWch2MaVoAcf0OAABFXx81Ze8pkNfo8yBU01K uR2TCt2mIBqUnDzwbIuCrXpqYEPn7r+oQip12TYM6allX9FkQ6eX3cEEJFWzIwR0bW W2Xoh5cEEVwFg== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2023-52491: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run Date: Thu, 29 Feb 2024 15:52:51 +0000 Message-ID: <20240229155245.1571576-32-lee@kernel.org> X-Mailer: git-send-email 2.44.0.rc1.240.g4c46232300-goog Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3480; i=lee@kernel.org; h=from:subject; bh=LIOWkKuyoojmpK7TbIuB6Yb/ARauC1qmukZ5SeY0P00=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBl4KhOlMWAsjY/nu2I3+Bo8EYBFWkqhBS8RPO2S lPdg6zOZBWJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCZeCoTgAKCRBRr4ovh/x3 YbiYEAChjkMZl1QeCpCRGRNH0cUAv+INRupV2CSXqnGg66REVJsUiACUT4xyDY3S0/ZiiYG6qa6 pT80Q101+zyFFoL8c3inl62UWZGxQdtuOzHXX92JFOuBL5VIsd1/nLFPewoqSgNhuViTn7g9XoK PP/JNV3I4u9fONsOpoCUFbv//YXYtdxHaxcdLDTpYkbiBCZ1eSsLQoNi2yb53ZjTgGxNxcD0ztT mx5EsB0qwrZGQF+P9MISu34GzZhVDYXBjaHHMcjsDEXBVDvX7OKeAQPU9d086oXi5hPXalbbmB7 8fmNgDQByiDuYSl3284KffOoYdSH4l+raxp2zeW2kOn9kQ+OD2E3DlRSf8y9sa9xjVXSQgfIV95 3N40tZt/2XEZ2jFsKjW27kUOa14kYwjz2SXiBgoP21kn+Ft2KH0yclRtrVCtvtq/DJLqeykJYWE WUvGr16l0SQYN1xeGVQ3A5xlEBSJ2GcYCM9VgJsjclG2YqDKmZLlixObBynkcEMTMpuAftzGnNP 0HYPdavQ1ZORY5ar1hk76XomC3UzcRcbt/4eberImK/7cJQ0uab97tuIJjWbdWb1JacZKbNL7FK 74o12glC9dzZwNqdBD8V/Jvs5ricVcOnXzqZKZ8Zk8uNpP+FvzCJbPBXNNiH1ewM6YA5al2XBju qZN6xXtIS9XoJ+g== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_dec_device_run, if error happens in mtk_jpeg_set_dec_dst, it will finally start the worker while mark the job as finished by invoking v4l2_m2m_job_finish. There are two methods to trigger the bug. If we remove the module, it which will call mtk_jpeg_remove to make cleanup. The possible sequence is as follows, which will cause a use-after-free bug. CPU0 CPU1 mtk_jpeg_dec_... | start worker | |mtk_jpeg_job_timeout_work mtk_jpeg_remove | v4l2_m2m_release | kfree(m2m_dev); | | | v4l2_m2m_get_curr_priv | m2m_dev->curr_ctx //use If we close the file descriptor, which will call mtk_jpeg_release, it will have a similar sequence. Fix this bug by starting timeout worker only if started jpegdec worker successfully. Then v4l2_m2m_job_finish will only be called in either mtk_jpeg_job_timeout_work or mtk_jpeg_dec_device_run. The Linux kernel CVE team has assigned CVE-2023-52491 to this issue. Affected and fixed versions =========================== Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 5.10.210 with commit 43872f44eee6 Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 5.15.149 with commit 1b1036c60a37 Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 6.1.76 with commit 9fec4db7fff5 Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 6.6.15 with commit 8254d54d00eb Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 6.7.3 with commit 6e2f37022f0f Issue introduced in 4.12 with commit b2f0d2724ba4 and fixed in 6.8-rc1 with commit 206c857dd17d Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52491 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/43872f44eee6c6781fea1348b38885d8e78face9 https://git.kernel.org/stable/c/1b1036c60a37a30caf6759a90fe5ecd06ec35590 https://git.kernel.org/stable/c/9fec4db7fff54d9b0306a332bab31eac47eeb5f6 https://git.kernel.org/stable/c/8254d54d00eb6cdb8367399c7f912eb8d354ecd7 https://git.kernel.org/stable/c/6e2f37022f0fc0893da4d85a0500c9d547fffd4c https://git.kernel.org/stable/c/206c857dd17d4d026de85866f1b5f0969f2a109e