CVE-2024-42313 – This CVE describes a use-after-free vulnerabili... (How to Fix)

Q: What is the severity of CVE-2024-42313?

CVE-2024-42313 has a CVSS score of 7.8 (HIGH). This CVE describes a use-after-free vulnerability in the Linux kernel's Venus video decoder driver. Attackers could potentially exploit this to crash the system or execute arbitrary code with kernel privileges. Systems using the Venus video decoder driver for hardware-accelerated video decoding are affected.

📋 TL;DR

This CVE describes a use-after-free vulnerability in the Linux kernel's Venus video decoder driver. Attackers could potentially exploit this to crash the system or execute arbitrary code with kernel privileges. Systems using the Venus video decoder driver for hardware-accelerated video decoding are affected.

💻 Affected Systems

Products:

Linux kernel with Venus video decoder driver

Versions: Specific kernel versions with the vulnerable code before the fix commits

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires the Venus video decoder driver to be loaded and in use. Affects systems with Qualcomm Venus video hardware acceleration.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory corruption leading to arbitrary code execution with kernel privileges, potentially resulting in full system compromise.

🟠

Likely Case

System crash or kernel panic causing denial of service, potentially requiring physical access to restart.

🟢

If Mitigated

Limited impact if proper kernel hardening and access controls are in place, likely resulting in system instability rather than full compromise.

🌐 Internet-Facing: LOW - Requires local access to the video decoder device interface.

🏢 Internal Only: MEDIUM - Local users or processes with access to video decoding functionality could trigger the vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to trigger the vdec_close function during active decoding operations.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits: 4c9d235630d35db762b85a4149bbb0be9d504c36, 66fa52edd32cdbb675f0803b3c4da10ea19b6635, 6a96041659e834dc0b172dda4b2df512d63920c2, 72aff311194c8ceda934f24fd6f250b8827d7567, a0157b5aa34eb43ec4c5510f9c260bbb03be937e

Vendor Advisory: https://git.kernel.org/stable/c/4c9d235630d35db762b85a4149bbb0be9d504c36

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Reboot the system. 3. Verify the fix is applied by checking kernel version or verifying the specific commit is present.

🔧 Temporary Workarounds

Disable Venus video decoder module

linux

Prevent loading of the vulnerable Venus video decoder driver

echo 'blacklist venus_dec' >> /etc/modprobe.d/blacklist-venus.conf
update-initramfs -u
reboot

Restrict video decoder device access

linux

Limit access to the video decoder device to trusted users only

chmod 600 /dev/video-dec
chown root:root /dev/video-dec

🧯 If You Can't Patch

Restrict local user access to systems using Venus video decoding
Implement strict process isolation and sandboxing for video decoding applications

🔍 How to Verify

Check if Vulnerable:

Check if Venus decoder module is loaded: lsmod | grep venus_dec. Check kernel version against affected versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: git log --oneline | grep -E '4c9d235630d35db762b85a4149bbb0be9d504c36|66fa52edd32cdbb675f0803b3c4da10ea19b6635|6a96041659e834dc0b172dda4b2df512d63920c2|72aff311194c8ceda934f24fd6f250b8827d7567|a0157b5aa34eb43ec4c5510f9c260bbb03be937e'

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
OOM killer messages related to venus_dec
System crash dumps

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("venus" OR "vdec_close" OR "use after free")

📊 Metadata

CVE ID: CVE-2024-42313

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: August 17, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-42313, you might also want to check these: