77 lines
3.9 KiB
Markdown
77 lines
3.9 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
The following versions of MPP are currently supported with security updates:
|
|
|
|
| Version | Supported |
|
|
| :--------------------------- | :----------------------------- |
|
|
| develop branch (latest) | ✅ Fully supported |
|
|
| release branch (latest) | ✅ Fully supported |
|
|
| Older release branches | ⚠️ Critical security fixes only |
|
|
| Archived versions (< 1.0) | ❌ No longer supported |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not** report security vulnerabilities through public GitHub issues, as this could expose the vulnerability to malicious actors.
|
|
|
|
If you discover a security vulnerability in MPP, please report it privately using the following methods:
|
|
|
|
### Reporting Channels
|
|
|
|
1. **Primary Contact** (Recommended)
|
|
- Email the maintainer at: **herman.chen@rock-chips.com**
|
|
- Subject format: `[SECURITY] MPP vulnerability report - [brief description]`
|
|
|
|
2. **Alternative Channel**
|
|
- If you cannot reach the primary maintainer, please email: rockchip-opensource@rock-chips.com
|
|
- Or submit a private ticket via [Rockchip Redmine](http://redmine.rockchip.com.cn)
|
|
|
|
### Report Content
|
|
|
|
Please include the following information to help us quickly locate and fix the issue:
|
|
|
|
- **Vulnerability Description**: Type of vulnerability (e.g., buffer overflow, use-after-free, integer overflow) and scope of impact
|
|
- **Affected Versions**: Specific MPP version or Git commit hash
|
|
- **Affected Components**: Specific modules (e.g., codec/parser/HAL/OSAL/allocator, etc.)
|
|
- **Environment Details**:
|
|
- Rockchip SoC model (e.g., RK3588, RK3568, etc.)
|
|
- Operating system (Linux/Android version)
|
|
- Kernel version
|
|
- **Reproduction Steps**: Detailed steps to reproduce or PoC (Proof of Concept) code
|
|
- **Suggested Fix** (optional): If you have a proposed fix, please include it
|
|
|
|
## Response Process
|
|
|
|
Upon receiving a security report, the maintenance team will follow this process:
|
|
|
|
| Timeframe | Action |
|
|
| :------------------ | :----------------------------------------------------------- |
|
|
| Within 48 hours | Acknowledge receipt and begin initial assessment |
|
|
| Within 7 days | Complete vulnerability verification and severity assessment, provide feedback |
|
|
| Within 30 days | Release security patch (critical vulnerabilities may be faster) |
|
|
| After patch release | Public disclosure of vulnerability details (coordinated disclosure) |
|
|
|
|
## Disclosure Policy
|
|
|
|
- **Coordinated Disclosure**: We follow coordinated disclosure principles. After the vulnerability is fixed, details will typically be publicly disclosed within 90 days, or adjusted according to the reporter's preferences
|
|
- **Acknowledgment**: Once the vulnerability is confirmed and fixed, we will credit the reporter in the release notes (unless you wish to remain anonymous)
|
|
- **CVE**: If a CVE identifier is needed, please let us know in advance and we will assist with the application
|
|
|
|
## Security Best Practices
|
|
|
|
When using MPP, the following security measures are recommended:
|
|
|
|
1. **Input Validation**: Ensure media streams passed to MPP come from trusted sources, or perform strict validation before decoding
|
|
2. **Memory Limits**: Use `mpp_buffer_group_limit_config` to limit memory usage and prevent resource exhaustion attacks
|
|
3. **Sandboxing**: Run MPP-related processes in a privilege-restricted environment
|
|
4. **Timely Updates**: Keep MPP updated to the latest version to receive the latest security fixes
|
|
5. **Kernel Security**: Ensure the underlying kernel drivers (vcodec_service/v4l2) are updated to the latest version
|
|
|
|
## Known Security Issues
|
|
|
|
View [GitHub Security Advisories](https://github.com/HermanChen/mpp/security/advisories) for publicly disclosed security announcements.
|
|
|
|
---
|
|
|
|
Thank you for contributing to MPP security!
|