CVE-2024-47753

What it actually does

Null pointer dereference in vdec_vp8_req_if.c when the framebuffer (fb) is NULL, resulting in a kernel crash in the MediaTek VP8 stateless decoder.

Why it matters to the business

Systems using the affected Linux kernel driver can experience unexpected crashes and reboots triggered by video decoding operations, leading to service outages and potential loss of unsaved work.

How an attack unfolds

An attacker supplies specially crafted VP8 video input or invokes the stateless decoder interface in a way that results in a null framebuffer pointer being passed to the decoder, causing the kernel to dereference the null value and panic.

How to fix it

Apply the upstream kernel fix for the smatch warning in media/mediatek/vcodec/vdec_vp8_req_if.c or update to a kernel release containing the resolution for this issue.

How to confirm the fix worked

Verify the fix is present by inspecting the vdec_vp8_req_if.c source for null checks on fb or confirm the absence of the smatch warning; test decoder paths with null framebuffer scenarios in a lab environment.

Typical attack path

1. Locate a target system running an unpatched Linux kernel with the MediaTek vcodec driver enabled
2. Trigger the VP8 stateless decoder path via userspace media APIs or video playback
3. Cause the framebuffer pointer to be NULL through malformed decoder requests
4. Trigger the null dereference to induce a kernel crash

How to detect it

Search kernel ring buffers and system logs for panic or oops messages referencing vdec_vp8_req_if.c, mediatek vcodec, or null pointer dereferences during VP8 decoding operations.

• vdec_vp8_req_if.c
• fb is NULL
• mediatek vcodec crash
• VP8 stateless decoder panic

What your security team should do

• Prioritize kernel updates on systems exposing media decoding functionality
• Monitor kernel logs for oops/panic entries involving mediatek vcodec or vdec_vp8
• Limit untrusted access to video decoding interfaces until patched