Kernel Crash Prevention in MediaTek Video Codec Driver - CVE-2022-49496
Summary
CVE-2022-49496: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko If the driver support subdev mode, the parameter "dev->pm.dev" will be NULL i... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. The MediaTek video codec driver (mtk-vcodec-dec) is designed to handle video decoding tasks efficiently. However, a vulnerability has been identified that can lead to kernel crashes when the driver is removed under certain conditions, particularly when the driver supports sub-device mode.
Vulnerability Detail
CVE-2022-49496 is a vulnerability in the MediaTek video codec driver within the Linux kernel. The issue arises when the driver is removed (rmmod) while in sub-device mode, resulting in a NULL pointer dereference. This can cause the kernel to crash, leading to system instability and potential data loss. The vulnerability is triggered during the cleanup process of the driver, specifically in the mtk_vcodec_dec_remove function, where the device's power management structure is improperly handled.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid removing the mtk-vcodec-dec driver while in sub-device mode to prevent triggering the crash. Additionally, users can monitor the system for any unusual behavior and ensure that critical data is backed up.
Conclusion
CVE-2022-49496 is a significant vulnerability in the MediaTek video codec driver that can lead to kernel crashes if not addressed. Users are advised to update their Linux kernel to the latest patched version to mitigate risks. Temporary workarounds can help, but the best course of action is to apply the necessary updates.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49496 is a vulnerability in the MediaTek video codec driver that can cause kernel crashes when the driver is removed under specific conditions.
If exploited, this vulnerability can lead to system crashes, instability, and potential data loss, especially when the driver is removed while in use.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If an immediate update is not possible, avoid removing the mtk-vcodec-dec driver while it is in use to prevent crashes.
Detailed information about CVE-2022-49496 can be found in the official CVE database and security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
