Cloudanix VulnDB

CVE-2024-21783

Medium · 4.8

CVSS

4.8

EPSS

0.2%

Published

Nov 13, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in video processing software on some Ubuntu systems could let someone already logged in locally gain extra permissions they should not have.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer overflow in Intel VPL software before 24.1.4 triggers memory corruption that can be leveraged by a local authenticated user to escalate privileges.

Why it matters to the business

Local users on affected Ubuntu systems could obtain elevated access, increasing the risk of unauthorized actions on media-processing workloads without remote attack surface.

How an attack unfolds

An authenticated local user supplies crafted input to the vulnerable VPL component, triggering the integer overflow to corrupt memory structures and execute code with higher privileges.

How to fix it

Upgrade affected packages to the listed fixed kernel versions: linux 5.4.0-9.12, linux-aws 5.4.0-1005.5, linux-aws-5.15 5.15.0-1014.18~20.04.1, linux-azure 5.4.0-1006.6, linux-azure-5.15 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 5.15.0-1019.24~20.04.1.1, linux-bluefield 5.4.0-1007.10, linux-gcp 5.4.0-1005.5, linux-gcp-5.15 5.15.0-1006.9~20.04.1, linux-gkeop 5.4.0-1008.9, linux-gkeop-5.15 5.15.0-1003.5~20.04.2, linux-hwe-5.15 5.15.0-33.34~20.04.1, linux-ibm 5.4.0-1003.4. Apply updates via standard package manager and reboot if required.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases listed above using dpkg or apt; verify VPL library version is 24.1.4 or newer where applicable.

Typical attack path

  1. Obtain local authenticated access to an affected Ubuntu system
  2. Identify presence of vulnerable Intel VPL library in media or graphics processing paths
  3. Craft and submit input that triggers the integer overflow
  4. Achieve memory corruption leading to privilege escalation

How to detect it

Review local authentication logs and process execution history around media-processing binaries for unusual privilege transitions; no remote indicators apply.

What your security team should do

  • Prioritize patching all listed Ubuntu kernel packages to the specified fixed versions
  • Audit systems for Intel VPL usage in media pipelines and restrict local access where possible
  • Monitor for future Intel VPL updates and include in regular patch cycles

The record

Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 intel-mediasdk 0 No fix
Debian:12 intel-mediasdk 0 No fix
Debian:12 onevpl-intel-gpu 0 No fix
Debian:13 onevpl-intel-gpu 0 24.3.3-1
Ubuntu:20.04:LTS intel-mediasdk 0 No fix
Ubuntu:22.04:LTS intel-mediasdk 0 No fix
Ubuntu:22.04:LTS onevpl-intel-gpu 0 No fix
Ubuntu:24.04:LTS intel-mediasdk 0 No fix
Ubuntu:24.04:LTS onevpl-intel-gpu 0 No fix
Ubuntu:24.10 intel-mediasdk 0 No fix
Ubuntu:24.10 onevpl-intel-gpu 0 24.3.4-1
Ubuntu:Pro:20.04:LTS intel-mediasdk 0 No fix

Related vulnerabilities