CVE-2024-35919

What it actually does

The vulnerability is a race condition in the MediaTek VCodec driver where the encoder context list (ctx_list) lacks proper locking, allowing a NULL pointer dereference in vpu_enc_ipi_handler if the list is modified unexpectedly by the SCP IP block.

Why it matters to the business

Systems using MediaTek video encoding hardware may experience kernel panics or crashes, leading to system instability and potential denial of service, though exploitation is not known to be widespread given the low EPSS and lack of KEV listing after 878 days.

How an attack unfolds

An attacker with local access could potentially trigger conditions on the SCP IP block to delete the context list while the handler is accessing it, causing a NULL pointer access. No public exploits or threat actors are associated with this issue.

How to fix it

Apply the kernel patch from commit 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5 or update to a Linux kernel version that includes this fix in the stable tree.

How to confirm the fix worked

Verify the presence of commit 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5 in the kernel source tree or exercise MediaTek encoder paths under concurrent load to confirm absence of NULL dereferences.

Typical attack path

1. Obtain local access on an affected Linux system
2. Trigger video encoding operations involving the MediaTek VCodec
3. Induce unexpected SCP IP block behavior to concurrently modify ctx_list during handler execution

How to detect it

Review kernel logs and oops reports for NULL pointer dereference patterns involving vpu_enc_ipi_handler or mediatek vcodec encoder context handling.

What your security team should do

• Prioritize kernel updates containing commit 41671f0c0182b2bae74ca7e3b0f155559e3e2fc5 on systems with MediaTek VCodec hardware
• Review kernel configurations to disable unused MediaTek encoder support where feasible
• Monitor kernel logs for vcodec-related faults as a precautionary measure