Null Pointer Dereference in Linux Kernel's Media MTK VCodec Package
Summary
CVE-2024-40973: In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The media subsystem, particularly the MTK VCodec, is responsible for video encoding and decoding functionalities. This subsystem is critical for multimedia applications, and vulnerabilities within it can lead to severe operational issues, including system crashes or data corruption.
Vulnerability Detail
CVE-2024-40973 is a vulnerability found in the Linux kernel's media subsystem, specifically within the MTK VCodec. The issue arises from a failure to check the return value of the devm_kzalloc() function, which can lead to a null pointer dereference. This oversight can cause the system to crash or behave unpredictably when the memory allocation fails. The vulnerability is similar to CVE-2022-3113, indicating a recurring issue in memory management within the kernel's media components.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the necessary updates as soon as they are available.
Conclusion
CVE-2024-40973 represents a significant vulnerability within the Linux kernel's media subsystem, specifically affecting the MTK VCodec. Users are advised to update their systems promptly to mitigate potential risks associated with this issue. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-40973 is a vulnerability in the Linux kernel's media subsystem that can lead to a null pointer dereference due to improper memory allocation checks.
If exploited, this vulnerability can cause system crashes or unpredictable behavior, particularly in applications relying on the MTK VCodec for media processing.
The vulnerability affects multiple versions of the Linux kernel across Debian 11, 12, and 13, with specific fixes available in later releases.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for CVE-2024-40973 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
