Critical Use-After-Free Vulnerability in Linux Kernel (Debian:13 and Debian:14)
Summary
DEBIAN-CVE-2024-35921: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initializa... Affects linux versions < 6.8.9-1. Fixed in 6.8.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Debian operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. This vulnerability specifically affects the MediaTek video codec driver, which is responsible for handling video processing tasks. The vulnerability arises from improper handling of instance pointers during the initialization of the HEVC decoder, leading to potential system instability and security risks.
Vulnerability Detail
In the Linux kernel, a use-after-free vulnerability has been identified in the MediaTek video codec driver. This issue occurs when the stateless HEVC decoder saves the instance pointer in the context without verifying if the initialization was successful. If the initialization fails, the pointer is freed, leading to a use-after-free condition. This can result in system crashes, data corruption, or unauthorized access to sensitive information. The vulnerability is tracked as DEBIAN-CVE-2024-35921 and affects both Debian 13 and Debian 14 versions of the Linux package.
How To Fix
Minimum fixed version
6.8.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating to the fixed version of the Linux kernel.
Conclusion
The identified use-after-free vulnerability in the Linux kernel poses significant risks to systems running Debian 13 and Debian 14. Users are strongly advised to update their Linux kernel package to the patched version 6.8.9-1 to ensure system security and stability. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed. This can lead to unpredictable behavior, crashes, or security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file, such as package-lock.json, you can check if your application is affected by this vulnerability.
The risks include system crashes, data corruption, and potential unauthorized access to sensitive information, which can compromise the integrity and security of the system.
Yes, the patched version of the Linux kernel is 6.8.9-1. Users should upgrade to this version to mitigate the vulnerability.
Detailed information about this vulnerability can be found in the official Debian CVE database and on the Vulert website, which provides real-time monitoring for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
