Executive brief
A vulnerability exists in the Linux kernel's AtomISP driver, which is used for Intel Image Processing Units (IPU) in certain mobile and embedded devices. If the system runs out of memory while trying to load video processing components, the driver may crash the entire system. This could allow a local user to cause a denial-of-service (system crash), impacting the availability of the device.
Technical details
A null-pointer dereference exists in the Linux kernel's AtomISP driver within the `load_video_binaries()` function in `drivers/staging/media/atomisp/pci/sh_css.c`. The vulnerability occurs when an allocation failure for `mycs->yuv_scaler_binary` is not properly handled before a subsequent call to `sh_css_pipe_unload_binaries()`. During the error cleanup path, `unload_video_binaries()` attempts to dereference the null pointer via `ia_css_binary_unload()`. This is a local vulnerability that can be triggered under low-memory conditions, leading to a kernel oops or system panic. Patches have been released across multiple stable kernel branches to ensure the scaler count is reset to zero upon allocation failure.
Affected products
- Linux Linux kernel 4.12 to 5.10.218, 5.11 to 5.15.160, 5.16 to 6.1.92, 6.2 to 6.6.32, 6.7 to 6.8.11, 6.9 to 6.9.2
Timeline
- 2024-06-19: disclosed
- 2024-06-19: advisory
References
- https://git.kernel.org/stable/c/3b621e9e9e148c0928ab109ac3d4b81487469acb
- https://git.kernel.org/stable/c/4b68b861b514a5c09220d622ac3784c0ebac6c80
- https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654
- https://git.kernel.org/stable/c/6482c433863b257b0b9b687c28ce80b89d5f89f0
- https://git.kernel.org/stable/c/69b27ff82f87379afeaaea4b2f339032fdd8486e
- https://git.kernel.org/stable/c/82c2c85aead3ea3cbceef4be077cf459c5df2272
- https://git.kernel.org/stable/c/a1ab99dcc8604afe7e3bccb01b10da03bdd7ea35