Bug 2269185 (CVE-2023-52491)

Summary: CVE-2023-52491 kernel: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
Product: [Other] Security Response Reporter: Marco Benatto <mbenatto>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: acaringi, allarkin, aquini, bhu, chwhite, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, ldoskova, lgoncalv, mleitner, mmilgram, mstowell, nmurray, ptalbert, rhel-process-autobot, rparrazo, rrobaina, rvrbovsk, scweaver, sidakwo, sukulkar, tglozar, vkumar, watson-tool-maintainers, wcosta, williams, wmealing, ycote, ykopkova
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.10.210, kernel 5.15.149, kernel 6.1.76, kernel 6.6.15, kernel 6.7.3, kernel 6.8-rc1 Doc Type: If docs needed, set a value
Doc Text:
This vulnerability in the Linux kernel affects the MediaTek JPEG (mtk-jpeg) media driver. The issue stems from improper error path handling within the decoder function. If a specific error occurs while setting up a decoding job, the driver mistakenly starts a timeout worker process even as it marks the job as finished. This creates a dangerous race condition: if the module is subsequently removed or the file descriptor is closed, the system cleans up and frees the associated memory. However, the improperly started timeout worker may still attempt to access that memory, triggering a use-after-free bug that can crash the kernel. Patched versions resolve this by ensuring the timeout worker is only launched if the main decoding worker successfully initializes, preventing the invalid memory access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2269186    
Bug Blocks: 2269239    

Description Marco Benatto 2024-03-12 15:53:10 UTC 
In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run

The Linux kernel CVE team has assigned CVE-2023-52491 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/20240229155245.1571576-32-lee@kernel.org/T
Comment 1 Marco Benatto 2024-03-12 15:53:47 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2269186]
Comment 2 Justin M. Forbes 2024-03-26 16:46:14 UTC 
This was fixed for Fedora with the 6.7.3 stable kernel updates.
Comment 3 Alex 2024-06-09 13:15:04 UTC 
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2023-52491 is: 	SKIP	No affected files built, so skip this CVE	NO			-	-	unknown (where first YES/NO value means if related sources built).