CVE-2024-42313 (GCVE-0-2024-42313)

Vulnerability from cvelistv5 – Published: 2024-08-17 09:09 – Updated: 2026-08-05 11:36
VLAI
Title
media: venus: fix use after free in vdec_close
Summary
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbacks as a normal part of decoding. Randomly closing the decoder device from userspace during normal decoding can incur a read after free for inst. Fix it by cancelling the work in vdec_close.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < ad8cf035baf29467158e0550c7a42b7bb43d1db6 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 72aff311194c8ceda934f24fd6f250b8827d7567 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 4c9d235630d35db762b85a4149bbb0be9d504c36 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < f8e9a63b982a8345470c225679af4ba86e4a7282 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < da55685247f409bf7f976cc66ba2104df75d8dad (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 66fa52edd32cdbb675f0803b3c4da10ea19b6635 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < 6a96041659e834dc0b172dda4b2df512d63920c2 (git)
Affected: af2c3834c8ca7cc65d15592ac671933df8848115 , < a0157b5aa34eb43ec4c5510f9c260bbb03be937e (git)
Create a notification for this product.
Linux Linux Affected: 4.13
Unaffected: 0 , < 4.13 (semver)
Unaffected: 4.19.320 , ≤ 4.19.* (semver)
Unaffected: 5.4.282 , ≤ 5.4.* (semver)
Unaffected: 5.10.224 , ≤ 5.10.* (semver)
Unaffected: 5.15.165 , ≤ 5.15.* (semver)
Unaffected: 6.1.103 , ≤ 6.1.* (semver)
Unaffected: 6.6.44 , ≤ 6.6.* (semver)
Unaffected: 6.10.3 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42313",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:09:52.303644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:26.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:04:32.858Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad8cf035baf29467158e0550c7a42b7bb43d1db6",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "72aff311194c8ceda934f24fd6f250b8827d7567",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "4c9d235630d35db762b85a4149bbb0be9d504c36",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "f8e9a63b982a8345470c225679af4ba86e4a7282",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "da55685247f409bf7f976cc66ba2104df75d8dad",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "66fa52edd32cdbb675f0803b3c4da10ea19b6635",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "6a96041659e834dc0b172dda4b2df512d63920c2",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            },
            {
              "lessThan": "a0157b5aa34eb43ec4c5510f9c260bbb03be937e",
              "status": "affected",
              "version": "af2c3834c8ca7cc65d15592ac671933df8848115",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/qcom/venus/vdec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.320",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.282",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.224",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.165",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.103",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.44",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: fix use after free in vdec_close\n\nThere appears to be a possible use after free with vdec_close().\nThe firmware will add buffer release work to the work queue through\nHFI callbacks as a normal part of decoding. Randomly closing the\ndecoder device from userspace during normal decoding can incur\na read after free for inst.\n\nFix it by cancelling the work in vdec_close."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the local V4L2 device node /dev/videoN via open/ioctl/close on the Qualcomm venus decoder; there is no remote or network-facing path to this code.\nAC:L - The attacker drives both sides of the race \u2014 they queue the decode buffers that cause the worker to be scheduled and they choose when to close the fd \u2014 and can retry in a tight open/decode/close loop while spraying the freed venus_inst slab.\nPR:L - No capability check exists on vdec_open/vdec_close or any ioctl on the path; only access to the video device node is needed, which unprivileged users have on Android (mediacodec), embedded, and desktop systems via the video group/logind ACLs.\nUI:N - The attacker performs the entire sequence \u2014 opening the decoder, streaming buffers, and closing the fd \u2014 with no action required from any other user.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The worker reads inst-\u003elock, inst-\u003edelayed_process, inst-\u003esession and inst-\u003ecore from freed memory, so a reclaimed and attacker-controlled slab object yields kernel memory disclosure primitives.\nI:H - mutex_lock() and list_del_init() write into the freed venus_inst, and session_process_buf() dereferences attacker-reclaimable pointers, giving a heap-spray-based write and control-flow hijack primitive.\nA:H - Operating on a kfree\u0027d instance with an already mutex_destroy\u0027d lock reliably produces list corruption, lock BUGs, and kernel panics, taking the system down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:36:35.213Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6"
        },
        {
          "url": "https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282"
        },
        {
          "url": "https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e"
        }
      ],
      "title": "media: venus: fix use after free in vdec_close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42313",
    "datePublished": "2024-08-17T09:09:17.334Z",
    "dateReserved": "2024-07-30T07:40:12.277Z",
    "dateUpdated": "2026-08-05T11:36:35.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-42313",
      "date": "2026-08-05",
      "epss": "0.00228",
      "percentile": "0.13566"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:00:26.000Z",
      "cve": "CVE-2024-42313",
      "id": "msrc_CVE-2024-42313",
      "initial_release_date": "2024-08-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "media: venus: fix use after free in vdec_close",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-42313.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42313\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-17T09:15:11.320\",\"lastModified\":\"2026-06-17T07:49:14.397\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: venus: fix use after free in vdec_close\\n\\nThere appears to be a possible use after free with vdec_close().\\nThe firmware will add buffer release work to the work queue through\\nHFI callbacks as a normal part of decoding. Randomly closing the\\ndecoder device from userspace during normal decoding can incur\\na read after free for inst.\\n\\nFix it by cancelling the work in vdec_close.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: venus: arreglar el use after free en vdec_close Parece haber un posible use after free con vdec_close(). El firmware agregar\u00e1 trabajo de liberaci\u00f3n de b\u00fafer a la cola de trabajos a trav\u00e9s de devoluciones de llamada HFI como parte normal de la decodificaci\u00f3n. Cerrar aleatoriamente el dispositivo decodificador desde el espacio de usuario durante la decodificaci\u00f3n normal puede generar una lectura despu\u00e9s de la liberaci\u00f3n por instante. Solucionarlo cancelando el trabajo en vdec_close.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/platform/qcom/venus/vdec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"ad8cf035baf29467158e0550c7a42b7bb43d1db6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"72aff311194c8ceda934f24fd6f250b8827d7567\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"4c9d235630d35db762b85a4149bbb0be9d504c36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"f8e9a63b982a8345470c225679af4ba86e4a7282\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"da55685247f409bf7f976cc66ba2104df75d8dad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"66fa52edd32cdbb675f0803b3c4da10ea19b6635\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"6a96041659e834dc0b172dda4b2df512d63920c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"af2c3834c8ca7cc65d15592ac671933df8848115\",\"lessThan\":\"a0157b5aa34eb43ec4c5510f9c260bbb03be937e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/platform/qcom/venus/vdec.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.320\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.282\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.224\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.165\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.103\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.44\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.3\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:09:52.303644Z\",\"id\":\"CVE-2024-42313\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.13\",\"versionEndExcluding\":\"4.19.320\",\"matchCriteriaId\":\"ACC6CF43-5ABC-413A-8970-EB5985568FE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.282\",\"matchCriteriaId\":\"A8961D98-9ACF-4188-BA88-44038B14BC28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.224\",\"matchCriteriaId\":\"5CCEDF13-293D-4E64-B501-4409D0365AFE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.165\",\"matchCriteriaId\":\"B4E2B568-3171-41DE-B519-F2B1A3600D94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.103\",\"matchCriteriaId\":\"E45EAC72-8329-4F99-8276-86AF9BB3496A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.44\",\"matchCriteriaId\":\"CC912330-6B41-4C6B-99AF-F3857FBACB6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.3\",\"matchCriteriaId\":\"92D388F2-1EAF-4CFA-AC06-5B26D762EA7D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:23:37+00:00",
      "cve": "CVE-2024-42313",
      "id": "CVE-2024-42313",
      "initial_release_date": "2024-08-17T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: venus: fix use after free in vdec_close",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-42313.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:04:32.858Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42313\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:09:52.303644Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:23.417Z\"}}], \"cna\": {\"title\": \"media: venus: fix use after free in vdec_close\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"ad8cf035baf29467158e0550c7a42b7bb43d1db6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"72aff311194c8ceda934f24fd6f250b8827d7567\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"4c9d235630d35db762b85a4149bbb0be9d504c36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"f8e9a63b982a8345470c225679af4ba86e4a7282\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"da55685247f409bf7f976cc66ba2104df75d8dad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"66fa52edd32cdbb675f0803b3c4da10ea19b6635\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"6a96041659e834dc0b172dda4b2df512d63920c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"af2c3834c8ca7cc65d15592ac671933df8848115\", \"lessThan\": \"a0157b5aa34eb43ec4c5510f9c260bbb03be937e\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/qcom/venus/vdec.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.320\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.282\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.224\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.103\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.44\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/qcom/venus/vdec.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad8cf035baf29467158e0550c7a42b7bb43d1db6\"}, {\"url\": \"https://git.kernel.org/stable/c/72aff311194c8ceda934f24fd6f250b8827d7567\"}, {\"url\": \"https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36\"}, {\"url\": \"https://git.kernel.org/stable/c/f8e9a63b982a8345470c225679af4ba86e4a7282\"}, {\"url\": \"https://git.kernel.org/stable/c/da55685247f409bf7f976cc66ba2104df75d8dad\"}, {\"url\": \"https://git.kernel.org/stable/c/66fa52edd32cdbb675f0803b3c4da10ea19b6635\"}, {\"url\": \"https://git.kernel.org/stable/c/6a96041659e834dc0b172dda4b2df512d63920c2\"}, {\"url\": \"https://git.kernel.org/stable/c/a0157b5aa34eb43ec4c5510f9c260bbb03be937e\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: venus: fix use after free in vdec_close\\n\\nThere appears to be a possible use after free with vdec_close().\\nThe firmware will add buffer release work to the work queue through\\nHFI callbacks as a normal part of decoding. Randomly closing the\\ndecoder device from userspace during normal decoding can incur\\na read after free for inst.\\n\\nFix it by cancelling the work in vdec_close.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.320\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.282\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.224\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.165\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.103\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.44\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.3\", \"versionStartIncluding\": \"4.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:29:59.392Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42313\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:29:59.392Z\", \"dateReserved\": \"2024-07-30T07:40:12.277Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-17T09:09:17.334Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.