CVE-2024-47754

What it actually does

Null pointer dereference in the H264 multi stateless decoder that crashes the kernel when the framebuffer pointer is NULL.

Why it matters to the business

Unexpected system crashes and denial of service on affected Linux systems, with potential for privilege escalation if combined with other flaws; high downstream impact due to kernel prevalence in servers and devices.

How an attack unfolds

An attacker supplies crafted H264 input that triggers the decoder path where the framebuffer pointer remains NULL, causing the kernel to dereference it and panic; listed threat actors have shown interest in similar kernel memory issues for initial access or escalation.

How to fix it

Update to a kernel version containing the fix for the smatch warning in vdec_h264_req_multi_if.c; for the listed RubyGems component update devise to version 3.5.4.

How to confirm the fix worked

Confirm the fix is present by checking kernel source for the resolved NULL check in the H264 decoder or by running smatch static analysis on the vcodec module; verify devise package version is 3.5.4 or later.

Typical attack path

1. Identify systems running vulnerable Linux kernel with mediatek vcodec support
2. Deliver malicious H264 stream or file to trigger multi stateless decoder
3. Trigger NULL framebuffer condition leading to kernel crash or further exploitation

How to detect it

Search kernel logs for oops or panic messages referencing vdec_h264_req_multi_if.c or NULL framebuffer dereference; inspect for exploitation attempts involving H264 streams in media processing contexts.

What your security team should do

• Prioritize kernel updates on all systems using mediatek video codec hardware
• Monitor for kernel oops or panic logs related to vdec_h264_req_multi_if
• Apply devise 3.5.4 update where the RubyGems package is present
• Review EPSS and threat actor activity for similar kernel memory issues