Linux Kernel
CVE-2024-35919
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires specific SCP unexpected-behavior timing, warranting AC:H; PR:L because local user access is needed; full kernel-level C/I/A impact applies if triggered.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: mediatek: vcodec: adding lock to protect encoder context list
Add a lock for the ctx_list, to avoid accessing a NULL pointer within the 'vpu_enc_ipi_handler' function when the ctx_list has been deleted due to an unexpected behavior on the SCP IP block.
AnalysisAI
NULL pointer dereference in the MediaTek video codec (vcodec) kernel driver allows a local attacker to crash the system or potentially escalate privileges on devices powered by MediaTek SoCs. The flaw exists in the vpu_enc_ipi_handler function, which can dereference a freed encoder context list pointer (ctx_list) when the SCP IP block encounters unexpected behavior during video encoding operations. No public exploit exists and EPSS sits at 0.23% (14th percentile), indicating very low real-world exploitation probability despite the high CVSS base score. Upstream kernel patches are available via three stable-tree commits.
Technical ContextAI
The vulnerable component is the MediaTek vcodec subsystem in the Linux kernel, specifically the VPU (Video Processing Unit) encoder IPI (Inter-Processor Interrupt) handler. MediaTek SoCs offload video codec workloads to a co-processor (SCP - System Control Processor), and the host kernel communicates with it via IPI messages. The ctx_list structure tracks active encoder contexts. A race condition arises when the SCP IP block behaves unexpectedly: the encoder context list can be freed (ctx_list deleted) while vpu_enc_ipi_handler is still mid-flight and attempts to dereference a pointer into that list. CWE-476 (NULL Pointer Dereference) accurately classifies the root cause - the fix introduces a mutex lock around ctx_list access to serialize deletion and handler access. Affected CPEs span broad Linux kernel versions through 6.9-rc3 (cpe:2.3:o:linux:linux_kernel:6.9:rc1/rc2/rc3).
RemediationAI
Apply one of the three upstream kernel stable patches: commit afaaf3a0f647a24a7bf6a2145d8ade37baaf75ad, 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5, or 51c84a8aac6e3b59af2b0e92ba63cabe2e641a2d, all available at git.kernel.org/stable. Distribution maintainers (e.g., Android/ChromeOS kernel forks, Debian, Ubuntu) should backport the relevant commit for their kernel series. As a compensating control where patching is not immediately possible, disabling or blacklisting the mtk-vcodec kernel module (modprobe -r mtk-vcodec if not in use) eliminates the attack surface entirely at the cost of losing hardware video encoding capability on MediaTek SoCs. No released tagged version number was independently confirmed from the input; consult your kernel distribution's changelog to identify the patched release for your series.
WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows atta
The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges
In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today