Kernel Vulnerability in Linux Package: NULL Pointer Dereference in MediaTek VCodec
Summary
CVE-2022-50383: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Can't set dst buffer to done when lat decode error Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat archi... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The Linux package in Debian distributions is crucial for system stability and performance. This specific vulnerability affects the MediaTek video codec, which is responsible for handling video data processing. The vulnerability arises from improper handling of buffer management during video decoding, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the MediaTek video codec (vcodec). When a latency decode error occurs, the core thread attempts to set the destination buffer as done using the v4l2_m2m_buf_done function. However, if the latency architecture calls v4l2_m2m_buf_done_and_job_finish to free the destination buffer during this error, it results in a NULL pointer dereference. This can lead to a crash of the kernel, potentially causing system instability and data loss.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround has been provided for this vulnerability. It is advisable to monitor the system for any updates and apply the patch as soon as it becomes available.
Conclusion
The CVE-2022-50383 vulnerability poses a significant risk to systems running affected versions of the Linux kernel, particularly in handling video data. It is crucial to apply the available patch to ensure system stability and security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50383 is a vulnerability in the Linux kernel related to the MediaTek video codec, which can lead to a NULL pointer dereference and system crash.
This vulnerability can cause instability in your system, leading to crashes and potential data loss during video processing tasks.
Yes, a patch is available in version 6.1.4-1 for Debian 12, 13, and 14. It is recommended to update to this version.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Detailed information can be found in the CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
