CVE-2024-42313 (GCVE-0-2024-42313)
Vulnerability from cvelistv5
Published
2024-08-17 09:09
Modified
2026-08-05 11:36
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.
References
Impacted products
Vendor Product Version
Linux Linux Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
Version: af2c3834c8ca7cc65d15592ac671933df8848115
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:52.303644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:26.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:32.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad8cf035baf29467158e0550c7a42b7bb43d1db6",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "72aff311194c8ceda934f24fd6f250b8827d7567",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "4c9d235630d35db762b85a4149bbb0be9d504c36",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "f8e9a63b982a8345470c225679af4ba86e4a7282",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "da55685247f409bf7f976cc66ba2104df75d8dad",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "66fa52edd32cdbb675f0803b3c4da10ea19b6635",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "6a96041659e834dc0b172dda4b2df512d63920c2",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "a0157b5aa34eb43ec4c5510f9c260bbb03be937e",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local V4L2 device node /dev/videoN via open/ioctl/close on the Qualcomm venus decoder; there is no remote or network-facing path to this code.\nAC:L - The attacker drives both sides of the race \u2014 they queue the decode buffers that cause the worker to be scheduled and they choose when to close the fd \u2014 and can retry in a tight open/decode/close loop while spraying the freed venus_inst slab.\nPR:L - No capability check exists on vdec_open/vdec_close or any ioctl on the path; only access to the video device node is needed, which unprivileged users have on Android (mediacodec), embedded, and desktop systems via the video group/logind ACLs.\nUI:N - The attacker performs the entire sequence \u2014 opening the decoder, streaming buffers, and closing the fd \u2014 with no action required from any other user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The worker reads inst-\u003elock, inst-\u003edelayed_process, inst-\u003esession and inst-\u003ecore from freed memory, so a reclaimed and attacker-controlled slab object yields kernel memory disclosure primitives.\nI:H - mutex_lock() and list_del_init() write into the freed venus_inst, and session_process_buf() dereferences attacker-reclaimable pointers, giving a heap-spray-based write and control-flow hijack primitive.\nA:H - Operating on a kfree\u0027d instance with an already mutex_destroy\u0027d lock reliably produces list corruption, lock BUGs, and kernel panics, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:35.213Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282"
        },
        {
          "url": "https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e"
        }
      ],
      "title": "media: venus: fix use after free in vdec_close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42313",
    "datePublished": "2024-08-17T09:09:17.334Z",
    "dateReserved": "2024-07-30T07:40:12.277Z",
    "dateUpdated": "2026-08-05T11:36:35.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:04:32.858Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42313\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:09:52.303644Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.417Z\"}}], \"cna\": {\"title\": \"media: venus: fix use after free in vdec_close\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"ad8cf035baf29467158e0550c7a42b7bb43d1db6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"72aff311194c8ceda934f24fd6f250b8827d7567\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"4c9d235630d35db762b85a4149bbb0be9d504c36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"f8e9a63b982a8345470c225679af4ba86e4a7282\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"da55685247f409bf7f976cc66ba2104df75d8dad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"66fa52edd32cdbb675f0803b3c4da10ea19b6635\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"6a96041659e834dc0b172dda4b2df512d63920c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"a0157b5aa34eb43ec4c5510f9c260bbb03be937e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/qcom/venus/vdec.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.103\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/qcom/venus/vdec.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6\"}, {\"url\": \"https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567\"}, {\"url\": \"https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36\"}, {\"url\": \"https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282\"}, {\"url\": \"https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad\"}, {\"url\": \"https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635\"}, {\"url\": \"https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2\"}, {\"url\": \"https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: venus: fix use after free in vdec_close\\n\\nThere appears to be a possible use after free with vdec_close().\\nThe firmware will add buffer release work to the work queue through\\nHFI callbacks as a normal part of decoding. Randomly closing the\\ndecoder device from userspace during normal decoding can incur\\na read after free for inst.\\n\\nFix it by cancelling the work in vdec_close.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.320\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.103\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:29:59.392Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42313\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:29:59.392Z\", \"dateReserved\": \"2024-07-30T07:40:12.277Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:09:17.334Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.