{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-42313",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-42313"
  ],
  "published": "2024-08-17T09:11:20Z",
  "summary": "media: venus: fix use after free in vdec_close",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.103",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42313"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerability is reached only through the local V4L2 device node /dev/videoN via open/ioctl/close on the Qualcomm venus decoder; there is no remote or network-facing path to this code.\nAC:L - The attacker drives both sides of the race \u2014 they queue the decode buffers that cause the worker to be scheduled and they choose when to close the fd \u2014 and can retry in a tight open/decode/close loop while spraying the freed venus_inst slab.\nPR:L - No capability check exists on vdec_open/vdec_close or any ioctl on the path; only access to the video device node is needed, which unprivileged users have on Android (mediacodec), embedded, and desktop systems via the video group/logind ACLs.\nUI:N - The attacker performs the entire sequence \u2014 opening the decoder, streaming buffers, and closing the fd \u2014 with no action required from any other user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The worker reads inst->lock, inst->delayed_process, inst->session and inst->core from freed memory, so a reclaimed and attacker-controlled slab object yields kernel memory disclosure primitives.\nI:H - mutex_lock() and list_del_init() write into the freed venus_inst, and session_process_buf() dereferences attacker-reclaimable pointers, giving a heap-spray-based write and control-flow hijack primitive.\nA:H - Operating on a kfree'd instance with an already mutex_destroy'd lock reliably produces list corruption, lock BUGs, and kernel panics, taking the system down."
    }
  }
}