Kernel Panic Vulnerability in Linux Package: MediaTek VCodec Decoder Context Issue
Summary
DEBIAN-CVE-2024-35920: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect decoder context list Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_dec_... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is critical for system stability and performance. This specific vulnerability affects the MediaTek VCodec decoder context, which is responsible for handling video decoding tasks. The vulnerability arises from a lack of proper locking mechanisms, leading to potential system crashes and instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the MediaTek VCodec decoder context management. The issue stems from the absence of a lock protecting the decoder context list, which can result in accessing a NULL pointer within the 'vpu_dec_ipi_handler' function. This can occur if the context list is deleted unexpectedly, leading to a kernel panic and system crash. The vulnerability has been assigned the identifier DEBIAN-CVE-2024-35920 and affects both Debian 13 and 14 versions of the Linux package.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it is available to avoid potential system instability.
Conclusion
The identified vulnerability in the Linux package related to the MediaTek VCodec decoder context poses a significant risk of system instability and crashes. Users are urged to update to the patched version 6.8.9-1 or later to mitigate this risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to improper locking in the MediaTek VCodec decoder context, which can lead to kernel panic and system crashes.
The vulnerability affects Debian 13 and 14 versions of the Linux package.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is advisable to monitor your system closely for any signs of instability until the update can be applied.
Yes, a kernel panic can lead to system crashes, which may result in data loss if unsaved work is present.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
