CVE-2022-3113
published 2022-12-14CVE-2022-3113: An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.65%
47.7th percentile
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| debian | linux | < linux 6.1.133-1 (bookworm) | linux 6.1.133-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.133-1 (bookworm) | linux 6.1.133-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc < eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f | eeb62bb4ca22db17f7dfe8fb8472e0442df3d92f |
| linux | linux | >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc < f066882293b5ad359e44c4ed24ab1811ffb0b354 | f066882293b5ad359e44c4ed24ab1811ffb0b354 |
| linux | linux | >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc < 3a693c7e243b932faee5c1fb728efa73f0abc39b | 3a693c7e243b932faee5c1fb728efa73f0abc39b |
| linux | linux | >= 590577a4e5257ac3ed72999a94666ad6ba8f24bc < 53dbe08504442dc7ba4865c09b3bbf5fe849681b | 53dbe08504442dc7ba4865c09b3bbf5fe849681b |
| linux | linux_kernel | < 5.16.0 | 5.16.0 |
| linux | linux_kernel | < 6.6.36 | 6.6.36 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 6.1.133-1 | 6.1.133-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 6.9.7-1 | 6.9.7-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 6.9.7-1 | 6.9.7-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 6.7 < 6.9.7 | 6.9.7 |
| msrc | cbl2_kernel_5.15.86.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.158.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
cisa9.8CRITICAL
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: media: mtk-vcodec: potential null pointer deference in SCP
vendor_redhat·2024-07-12·CVSS 5.5
CVE-2024-40973 [MEDIUM] CWE-252 kernel: media: mtk-vcodec: potential null pointer deference in SCP
kernel: media: mtk-vcodec: potential null pointer deference in SCP
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-vcodec: potential null pointer deference in SCP
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
A flaw was found in the mtk-vcodec module in the Linux kernel. The mtk_vcodec_fw_scp_init function in the drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_fw_scp.c file does not check the return value of the devm_kzalloc function, potentially resulting in a NULL pointer dereference.
Statement: The mtk-vcodec module is not built in the kernel shipped in Red Hat Enterprise Linux, so it is not affected by this vulnerability.
Package: kernel (Red Hat Enterprise Linux 6) -
Debian
CVE-2024-40973: linux - In the Linux kernel, the following vulnerability has been resolved: media: mtk-...
vendor_debian·2024·CVSS 5.5
CVE-2024-40973 [MEDIUM] CVE-2024-40973: linux - In the Linux kernel, the following vulnerability has been resolved: media: mtk-...
In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.
Scope: local
bookworm: resolved (fixed in 6.1.133-1)
bullseye: open
forky: resolved (fixed in 6.9.7-1)
sid: resolved (fixed in 6.9.7-1)
trixie: resolved (fixed in 6.9.7-1)
Red Hat
kernel: media: mtk-vcodec: NULL pointer dereference in mtk_vcodec_fw_vpu_init()
vendor_redhat·2022-12-13·CVSS 5.5
CVE-2022-3113 [MEDIUM] CWE-476 kernel: media: mtk-vcodec: NULL pointer dereference in mtk_vcodec_fw_vpu_init()
kernel: media: mtk-vcodec: NULL pointer dereference in mtk_vcodec_fw_vpu_init()
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 9) - Not affected
Microsoft
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will
vendor_msrc·2022-12-13·CVSS 5.5
CVE-2022-3113 [MEDIUM] CWE-476 An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional produc
CISA
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
cisa·2022-04-13·CVSS 9.8
CVE-2015-3113 [CRITICAL] CWE-119 Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Vulnerability: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Affected: Adobe Flash Player
Heap-based buffer overflow vulnerability in Adobe Flash Player allows remote attackers to execute code.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-3113
Remediation Due Date: 2022-05-04
Debian
CVE-2022-3113: linux - An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_...
vendor_debian·2022·CVSS 5.5
CVE-2022-3113 [MEDIUM] CVE-2022-3113: linux - An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_...
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
Scope: local
bookworm: resolved (fixed in 5.17.3-1)
bullseye: resolved (fixed in 5.10.113-1)
forky: resolved (fixed in 5.17.3-1)
sid: resolved (fixed in 5.17.3-1)
trixie: resolved (fixed in 5.17.3-1)
OSV
CVE-2024-40973: In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of dev
osv·2024-07-12·CVSS 5.5
CVE-2024-40973 [MEDIUM] CVE-2024-40973: In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of dev
In the Linux kernel, the following vulnerability has been resolved: media: mtk-vcodec: potential null pointer deference in SCP The return value of devm_kzalloc() needs to be checked to avoid NULL pointer deference. This is similar to CVE-2022-3113.
GHSA
GHSA-g7g4-7563-37xc: In the Linux kernel, the following vulnerability has been resolved:
media: mtk-vcodec: potential null pointer deference in SCP
The return value of d
ghsa_unreviewed·2024-07-12·CVSS 5.5
CVE-2024-40973 [MEDIUM] CWE-476 GHSA-g7g4-7563-37xc: In the Linux kernel, the following vulnerability has been resolved:
media: mtk-vcodec: potential null pointer deference in SCP
The return value of d
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-vcodec: potential null pointer deference in SCP
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Kernel
media: mtk-vcodec: potential null pointer deference in SCP
kernel_security·2024-01-18·CVSS 5.5
CVE-2022-3113 [MEDIUM] media: mtk-vcodec: potential null pointer deference in SCP
media: mtk-vcodec: potential null pointer deference in SCP
The return value of devm_kzalloc() needs to be checked to avoid
NULL pointer deference. This is similar to CVE-2022-3113.
Link: https://lore.kernel.org/linux-media/PH7PR20MB5925094DAE3FD750C7E39E01BF712@PH7PR20MB5925.namprd20.prod.outlook.com
Signed-off-by: Fullway Wang
Signed-off-by: Mauro Carvalho Chehab
GHSA
GHSA-mrvv-fwrw-5pgv: An issue was discovered in the Linux kernel through 5
ghsa_unreviewed·2022-12-14
CVE-2022-3113 [MEDIUM] CWE-476 GHSA-mrvv-fwrw-5pgv: An issue was discovered in the Linux kernel through 5
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
OSV
CVE-2022-3113: An issue was discovered in the Linux kernel through 5
osv·2022-12-14·CVSS 5.5
CVE-2022-3113 [MEDIUM] CVE-2022-3113: An issue was discovered in the Linux kernel through 5
An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of the return value of devm_kzalloc() and will cause the null pointer dereference.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=2153053https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e25a89f743b18c029bfbe5e1663ae0c7190912b0https://bugzilla.redhat.com/show_bug.cgi?id=2153053https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e25a89f743b18c029bfbe5e1663ae0c7190912b0
2022-12-14
Published