CVE-2024-35921

What it actually does

A use-after-free occurs in the MediaTek VCodec driver when the stateless HEVC decoder stores the instance pointer in the context even if initialization fails; the pointer is later dereferenced after being freed during deinitialization in vcodec_vpu_send_msg.

Why it matters to the business

Kernel crashes or potential code execution during HEVC video decoding can disrupt media playback and system stability on affected Linux and Android devices; high ecosystem prevalence in consumer hardware increases exposure for device fleets until kernels are updated.

How an attack unfolds

An attacker supplies a crafted HEVC stream that forces init failure, then triggers decoder release; the dangling pointer is used in subsequent vpu messaging, enabling memory corruption that threat actors targeting Android kernel RCE could chain for privilege escalation.

How to fix it

Apply the kernel patch from commit ec25fc3c2c1e8958a51abcfed614f81446d918c4 which ensures the instance pointer is stored only after successful HEVC initialization; rebuild and deploy updated kernels containing this fix across affected stable branches.

How to confirm the fix worked

Confirm the commit ec25fc3c2c1e8958a51abcfed614f81446d918c4 is present in the kernel git tree or running image; reproduce HEVC init-failure scenarios and verify no use-after-free oops occurs in mtk_vcodec_dec.

Typical attack path

1. Deliver malicious HEVC content or app that triggers decoder initialization failure
2. Force decoder deinit path via release or error handling
3. Trigger use of the freed instance pointer in vcodec_vpu_send_msg to corrupt kernel memory
4. Escalate via the resulting corruption for code execution or denial of service

How to detect it

Inspect kernel logs and dmesg for oops traces involving mtk_vcodec_dec, vcodec_vpu_send_msg, vdec_hevc_slice_deinit, and vpu_dec_deinit; correlate with fops_vcodec_release calls during media decoder shutdown.

• vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec]
• vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec]
• fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec]
• vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec]

What your security team should do

• Expedite deployment of kernels containing ec25fc3c2c1e8958a51abcfed614f81446d918c4 on all MediaTek VCodec devices
• Restrict processing of untrusted HEVC streams until patches are applied
• Enable kernel hardening features such as KASAN or memory tagging to detect use-after-free during testing