Executive brief
A memory leak vulnerability exists in the Linux kernel's i.MX media driver, which handles video scaling and color space conversion. This flaw allows a local user to gradually consume system memory by repeatedly triggering certain media operations, potentially leading to a system crash or performance degradation. The issue has been resolved in various stable kernel updates.
Technical details
A memory leak vulnerability (CWE-401) was identified in the Linux kernel's i.MX media driver within the csc/scaler component. The root cause is the failure to free memory allocated by 'v4l2_ctrl_handler_init' during the release phase of the 'ipu_csc_scaler' device. A local attacker with low privileges can exploit this by repeatedly opening and closing the media device, causing the kernel to leak memory until the system encounters an Out-of-Memory (OOM) condition. The fix involves adding a call to 'v4l2_ctrl_handler_free' in the 'ipu_csc_scaler_release' function. Patches have been backported to multiple stable kernel branches including 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.7.y, and 6.8.y.
Affected products
- Linux Linux Kernel 5.4 to 5.4.273, 5.5 to 5.10.214, 5.11 to 5.15.153, 5.16 to 6.1.83, 6.2 to 6.6.23, 6.7 to 6.7.11, 6.8 to 6.8.2
Timeline
- 2024-05-01: advisory: Initial publication of the CVE record.
- 2024-02-16: patched: Mainline kernel patch committed.
References
- https://git.kernel.org/stable/c/42492b00156c03a79fd4851190aa63045d6a15ce
- https://git.kernel.org/stable/c/4797a3dd46f220e6d83daf54d70c5b33db6deb01
- https://git.kernel.org/stable/c/5d9fe604bf9b5b09d2215225df55f22a4cbbc684
- https://git.kernel.org/stable/c/6c92224721a439d6350db5933a1060768dcd565e
- https://git.kernel.org/stable/c/8c2e4efe1278cd2b230cdbf90a6cefbf00acc282
- https://git.kernel.org/stable/c/8df9a3c7044b847e9c4dc7e683fd64c6b873f328
- https://git.kernel.org/stable/c/b1d0eebaf87cc9ccd05f779ec4a0589f95d6c18b