CVE-2024-35919 (GCVE-0-2024-35919)

Vulnerability from cvelistv5 – Published: 2024-05-19 10:10 – Updated: 2026-08-05 11:30
VLAI
Title
media: mediatek: vcodec: adding lock to protect encoder context list
Summary
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: adding lock to protect encoder context list Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_enc_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-31 14:03 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1972e32431ed14682909ad568c6fd660572ae6ab , < 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5 (git)
Affected: 1972e32431ed14682909ad568c6fd660572ae6ab , < 51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d (git)
Affected: 1972e32431ed14682909ad568c6fd660572ae6ab , < afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.27 , ≤ 6.6.* (semver)
Unaffected: 6.8.6 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: 1972e32431ed , < 41671f0c0182 (custom)
Affected: 1972e32431ed , < 51c84a8aac6e (custom)
Affected: 1972e32431ed , < afaaf3a0f647 (custom)
Affected: 6.6
Affected: 0 , < 6.6* (custom)
Affected: 6.6.27 , ≤ 6.6* (custom)
Affected: 6.8.6 , ≤ 6.8* (custom)
Affected: 6.9 , ≤ * (custom)
    cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "41671f0c0182",
                "status": "affected",
                "version": "1972e32431ed",
                "versionType": "custom"
              },
              {
                "lessThan": "51c84a8aac6e",
                "status": "affected",
                "version": "1972e32431ed",
                "versionType": "custom"
              },
              {
                "lessThan": "afaaf3a0f647",
                "status": "affected",
                "version": "1972e32431ed",
                "versionType": "custom"
              },
              {
                "status": "affected",
                "version": "6.6"
              },
              {
                "lessThan": "6.6*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.6*",
                "status": "affected",
                "version": "6.6.27",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "6.8*",
                "status": "affected",
                "version": "6.8.6",
                "versionType": "custom"
              },
              {
                "lessThanOrEqual": "*",
                "status": "affected",
                "version": "6.9",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35919",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-31T14:03:42.763507Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-31T14:08:27.502Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.013Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
            "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "41671f0c0182b2bae74ca7e3b0f155559e3e2fc5",
              "status": "affected",
              "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
              "versionType": "git"
            },
            {
              "lessThan": "51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d",
              "status": "affected",
              "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
              "versionType": "git"
            },
            {
              "lessThan": "afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad",
              "status": "affected",
              "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
            "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
            "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.27",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: adding lock to protect encoder context list\n\nAdd a lock for the ctx_list, to avoid accessing a NULL pointer\nwithin the \u0027vpu_enc_ipi_handler\u0027 function when the ctx_list has\nbeen deleted due to an unexpected behavior on the SCP IP block."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached by opening the MediaTek V4L2 encoder device node (/dev/videoN) and issuing encode ioctls that trigger SCP/VPU IPI replies into vpu_enc_ipi_handler(); no network or physical access is involved.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues encode operations generating asynchronous SCP IPI callbacks while another thread repeatedly opens/closes encoder contexts to free the ctx mid-traversal; the handler runs in IRQ/workqueue context and can preempt the releasing task, and the window covers the whole unlocked list walk.\nPR:L - Requires only an unprivileged local process with access to the encoder video device node, which on Android and ChromeOS MediaTek devices is granted to ordinary media/codec HAL and sandboxed video processes; no CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker\u0027s own processes perform every step \u2014 open, encode, and close \u2014 with no action required from any other user.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The unlocked traversal dereferences a freed mtk_vcodec_enc_ctx, and reclaiming that slab object lets the attacker control list.next, turning the walk into a controlled kernel-memory read oracle (comparing ctx-\u003evpu_inst at attacker-chosen addresses) capable of disclosing arbitrary kernel data.\nI:H - vpu_enc_check_ap_inst() is the validation gate for the firmware-supplied venc_inst pointer; a spurious true from the use-after-free lets handle_enc_init_msg() and the error path write vpu-\u003einst_addr/vpu-\u003evsi/vpu-\u003efailure/vpu-\u003esignaled through an unvalidated pointer, and heap-spray reclamation of the freed ctx provides a write primitive usable for control-flow hijacking.\nA:H - The use-after-free reliably produces a NULL/wild pointer dereference and kernel oops \u2014 an actual panic backtrace in vpu_dec_ipi_handler on a shipping MT8183 Chromebook is documented for the identical decoder-side bug \u2014 and following a corrupted list.next can also hang the CPU in IRQ context."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:58.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
        }
      ],
      "title": "media: mediatek: vcodec: adding lock to protect encoder context list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35919",
    "datePublished": "2024-05-19T10:10:31.707Z",
    "dateReserved": "2024-05-17T13:50:33.123Z",
    "dateUpdated": "2026-08-05T11:30:58.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35919",
      "date": "2026-10-01",
      "epss": "0.00239",
      "percentile": "0.13518"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: adding lock to protect encoder context list\n\nAdd a lock for the ctx_list, to avoid accessing a NULL pointer\nwithin the \u0027vpu_enc_ipi_handler\u0027 function when the ctx_list has\nbeen deleted due to an unexpected behavior on the SCP IP block."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: mediatek: vcodec: a\u00f1adir bloqueo para proteger la lista de contexto del codificador. Agregue un bloqueo para ctx_list, para evitar acceder a un puntero NULL dentro de la funci\u00f3n \u0027vpu_enc_ipi_handler\u0027 cuando se ha eliminado ctx_list debido a un comportamiento inesperado en el bloque de IP de SCP."
        }
      ],
      "id": "CVE-2024-35919",
      "lastModified": "2024-11-21T09:21:12.250",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.0,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.0,
            "impactScore": 5.9,
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-05-19T11:15:48.303",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
                  "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "41671f0c0182b2bae74ca7e3b0f155559e3e2fc5",
                    "status": "affected",
                    "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d",
                    "status": "affected",
                    "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad",
                    "status": "affected",
                    "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
                  "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
                  "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.27",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.9",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "linux_kernel",
                "vendor": "linux",
                "versions": [
                  {
                    "lessThan": "41671f0c0182",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "51c84a8aac6e",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "afaaf3a0f647",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.6*",
                    "status": "affected",
                    "version": "6.6.27",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.8*",
                    "status": "affected",
                    "version": "6.8.6",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "affected",
                    "version": "6.9",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3301BF2B-8316-4F95-AE6D-3E81CA63F330",
                    "versionEndExcluding": "6.6.27",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "22CA5433-1303-41EF-AD4C-F4645DC01541",
                    "versionEndExcluding": "6.8.6",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "22BEDD49-2C6D-402D-9DBF-6646F6ECD10B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "52048DDA-FC5A-4363-95A0-A6357B4D7F8C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: adding lock to protect encoder context list\n\nAdd a lock for the ctx_list, to avoid accessing a NULL pointer\nwithin the \u0027vpu_enc_ipi_handler\u0027 function when the ctx_list has\nbeen deleted due to an unexpected behavior on the SCP IP block."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: mediatek: vcodec: a\u00f1adir bloqueo para proteger la lista de contexto del codificador. Agregue un bloqueo para ctx_list, para evitar acceder a un puntero NULL dentro de la funci\u00f3n \u0027vpu_enc_ipi_handler\u0027 cuando se ha eliminado ctx_list debido a un comportamiento inesperado en el bloque de IP de SCP."
          }
        ],
        "id": "CVE-2024-35919",
        "lastModified": "2026-08-04T11:18:11.370",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-35919",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-31T14:03:42.763507Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-19T11:15:48.303",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:58:35+00:00",
      "cve": "CVE-2024-35919",
      "id": "CVE-2024-35919",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: mediatek: vcodec: adding lock to protect encoder context list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35919.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-02T01:31:01Z",
      "cve": "CVE-2024-35919",
      "id": "CVE-2024-35919",
      "initial_release_date": "2024-05-21T01:59:13Z",
      "product_status:known_not_affected": "385",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35919",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35919.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T03:21:49.013Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "linux_kernel",
                "vendor": "linux",
                "versions": [
                  {
                    "lessThan": "41671f0c0182",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "51c84a8aac6e",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "lessThan": "afaaf3a0f647",
                    "status": "affected",
                    "version": "1972e32431ed",
                    "versionType": "custom"
                  },
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.6*",
                    "status": "affected",
                    "version": "6.6.27",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "6.8*",
                    "status": "affected",
                    "version": "6.8.6",
                    "versionType": "custom"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "affected",
                    "version": "6.9",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "HIGH",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-35919",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-31T14:03:42.763507Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-18T16:52:26.945Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
                "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
                "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
                "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "41671f0c0182b2bae74ca7e3b0f155559e3e2fc5",
                  "status": "affected",
                  "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                  "versionType": "git"
                },
                {
                  "lessThan": "51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d",
                  "status": "affected",
                  "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                  "versionType": "git"
                },
                {
                  "lessThan": "afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad",
                  "status": "affected",
                  "version": "1972e32431ed14682909ad568c6fd660572ae6ab",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_vpu.c",
                "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c",
                "drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h",
                "drivers/media/platform/mediatek/vcodec/encoder/venc_vpu_if.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.6"
                },
                {
                  "lessThan": "6.6",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.27",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.6",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.9",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.27",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.6",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9",
                      "versionStartIncluding": "6.6",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: adding lock to protect encoder context list\n\nAdd a lock for the ctx_list, to avoid accessing a NULL pointer\nwithin the \u0027vpu_enc_ipi_handler\u0027 function when the ctx_list has\nbeen deleted due to an unexpected behavior on the SCP IP block."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable code is reached by opening the MediaTek V4L2 encoder device node (/dev/videoN) and issuing encode ioctls that trigger SCP/VPU IPI replies into vpu_enc_ipi_handler(); no network or physical access is involved.\nAC:L - The attacker controls both sides of the race \u2014 one thread issues encode operations generating asynchronous SCP IPI callbacks while another thread repeatedly opens/closes encoder contexts to free the ctx mid-traversal; the handler runs in IRQ/workqueue context and can preempt the releasing task, and the window covers the whole unlocked list walk.\nPR:L - Requires only an unprivileged local process with access to the encoder video device node, which on Android and ChromeOS MediaTek devices is granted to ordinary media/codec HAL and sandboxed video processes; no CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker\u0027s own processes perform every step \u2014 open, encode, and close \u2014 with no action required from any other user.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The unlocked traversal dereferences a freed mtk_vcodec_enc_ctx, and reclaiming that slab object lets the attacker control list.next, turning the walk into a controlled kernel-memory read oracle (comparing ctx-\u003evpu_inst at attacker-chosen addresses) capable of disclosing arbitrary kernel data.\nI:H - vpu_enc_check_ap_inst() is the validation gate for the firmware-supplied venc_inst pointer; a spurious true from the use-after-free lets handle_enc_init_msg() and the error path write vpu-\u003einst_addr/vpu-\u003evsi/vpu-\u003efailure/vpu-\u003esignaled through an unvalidated pointer, and heap-spray reclamation of the freed ctx provides a write primitive usable for control-flow hijacking.\nA:H - The use-after-free reliably produces a NULL/wild pointer dereference and kernel oops \u2014 an actual panic backtrace in vpu_dec_ipi_handler on a shipping MT8183 Chromebook is documented for the identical decoder-side bug \u2014 and following a corrupted list.next can also hang the CPU in IRQ context."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:30:58.513Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/41671f0c0182b2bae74ca7e3b0f155559e3e2fc5"
            },
            {
              "url": "https://git.kernel.org/stable/c/51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d"
            },
            {
              "url": "https://git.kernel.org/stable/c/afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad"
            }
          ],
          "title": "media: mediatek: vcodec: adding lock to protect encoder context list",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-35919",
        "datePublished": "2024-05-19T10:10:31.707Z",
        "dateReserved": "2024-05-17T13:50:33.123Z",
        "dateUpdated": "2026-08-05T11:30:58.513Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.