CVE-2024-42313

A use-after-free vulnerability was found in the Linux kernel. The firmware can add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free. This issue could allow an attacker to execute his own code using the dangling pointer.

A moderate use-after-free vulnerability was found in the Linux kernel's Qualcomm Venus video decoder driver (drivers/media/platform/qcom/venus/vdec.c). As a normal part of decoding, the video firmware adds buffer release work to a work queue through HFI callbacks; if the decoder device is closed from userspace while decoding is in progress, this queued work can run after the decoder instance has been freed, resulting in a read after free. On systems using affected Qualcomm Venus hardware, a local attacker with access to the decoder device could potentially abuse the dangling pointer to execute code.

No Red Hat Enterprise Linux kernel or kernel-rt stream is listed as affected by this flaw. The only affected Red Hat-tracked product is Fedora, where the fix is delegated to the Fedora community kernel maintainers and has been delivered through Fedora kernel updates.

Red Hat Product Security rates this flaw as Moderate impact, lower than the NIST and CVE.org CVSS 3.1 base scores of 7.8 (Important), because exploitation requires local access with privileges to use the Venus video decoder on specific Qualcomm hardware and no Red Hat Enterprise Linux products are within the affected scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.