Kernel Crash Vulnerability in Linux Package: MediaTek H264 Stateless Decoder Issue
Summary
DEBIAN-CVE-2024-47752: In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix H264 stateless decoder smatch warning Fix a smatch static checker warning on vdec_h264_req_if.c. Affects linux versions < 6.11.2-1. Fixed in 6.11.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It is widely used across various distributions and is known for its stability and performance. However, like any complex software, it is susceptible to vulnerabilities that can impact system integrity and security. This specific vulnerability relates to the MediaTek H264 stateless decoder, which is responsible for decoding video streams in the H264 format.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the MediaTek H264 stateless decoder that leads to a kernel crash when the framebuffer (fb) is NULL. This issue arises from a smatch static checker warning in the vdec_h264_req_if.c file. If exploited, this vulnerability can cause system instability and crashes, potentially leading to data loss or service interruptions.
How To Fix
Minimum fixed version
6.11.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate risks.
Conclusion
The vulnerability identified in the Linux package related to the MediaTek H264 stateless decoder poses significant risks to system stability and security. Users are encouraged to update to the patched version to protect their systems from potential crashes and data loss.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a kernel crash issue in the MediaTek H264 stateless decoder that occurs when the framebuffer is NULL.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to system crashes, instability, and potential data loss.
Yes, a patch has been released in version 6.11.2-1 of the Linux package.
While there are no specific workarounds, it is crucial to prioritize updating your system to mitigate the risks associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
