CVE-2024-35920

What it actually does

Race condition in mtk_vcodec_dec allows concurrent deletion of ctx_list by unexpected SCP IP block behavior while vpu_dec_ipi_handler dereferences it, resulting in NULL pointer access and kernel panic.

Why it matters to the business

Unexpected kernel crashes on affected MediaTek-based systems cause device reboots, loss of ongoing media decode sessions, and potential denial of service in video processing workloads.

How an attack unfolds

An attacker with the ability to trigger SCP IP block anomalies forces ctx_list removal during active decoder context handling; the unprotected list access in vpu_dec_ipi_handler then dereferences freed or NULL memory, crashing the kernel.

How to fix it

Update the Linux kernel to include commit 0a2dc707aa42214f9c4827bd57e344e29a0841d6 which adds locking around ctx_list access in the mediatek vcodec decoder driver.

How to confirm the fix worked

Verify the running kernel contains commit 0a2dc707aa42214f9c4827bd57e344e29a0841d6 or later equivalent; confirm absence of the unprotected list walk in vpu_dec_ipi_handler via source inspection or kernel symbol checks.

Typical attack path

1. Gain local access or control over SCP IP block on affected MediaTek hardware
2. Trigger unexpected SCP behavior that deletes decoder ctx_list entries
3. Force vpu_dec_ipi_handler execution path that walks the now-invalid list
4. Induce NULL pointer dereference leading to kernel oops and panic

How to detect it

Search kernel logs and crash dumps for oops traces containing vpu_dec_ipi_handler, scp_ipi_handler, mtk_vcodec_dec, and ctx_list references; correlate with MediaTek SCP IRQ activity preceding the panic.

• vpu_dec_ipi_handler+0x58/0x1f8 [mtk_vcodec_dec]
• Kernel panic - not syncing: Oops: Fatal exception
• mt8183_scp_irq_handler
• scp_ipi_handler+0xd0/0x194 [mtk_scp]

What your security team should do

• Prioritize kernel updates containing the referenced commit on all MediaTek platforms using mtk_vcodec_dec
• Monitor for kernel oops and panic events involving mtk_vcodec_dec and mtk_scp modules
• Restrict untrusted local code execution on devices with MediaTek SCP video decode hardware until patched