Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values. But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields. And that can fail with these checks. So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that. That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
15ded23db134da975b49ea99770de0346c193b24 to < 0d73b49c4037199472b29574ae21c21aef493971affected3d43b2b8a3cdadd6cef9ac8ef5d156b6214a01c8 to < a2b56627c0d13009e02f6f2c0206c0451ed19a0eaffected9cf9211635b68e8e0c8cb88d43ca7dc83e4632aa to < 2572ab14b73aa45b6ae7e4c089ccf119fed5cf89affectedb4a3a01762ae072c7f6ff2ff53b5019761288346 to < 4afc77068e36cee45b39d4fdc7513de26980f72caffected683015ae163481457a16fad2317af66360dc4762 to < 32f01f0306a98629508f84d7ef0d1d037bc274a2affected491c0959f01d87bcbd5a1498bc70e0a3382c65a8 to < 6fb8bc29bfa80707994a63cc97e2f9920e0b0608affecteddc7276c3f6ca008be1faf531f84b49906c9bcf7f to < d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3affected4b6d66a45ed34a15721cb9e11492fa1a24bc83df to < 5eef2141776da02772c44ec406d6871a790761eeaffected
Linux Linux
Default version status: unaffected
4.9.332 to < 4.9.336affected4.14.298 to < 4.14.302affected4.19.264 to < 4.19.269affected5.4.223 to < 5.4.227affected5.10.153 to < 5.10.159affected5.15.77 to < 5.15.83affected6.0.7 to < 6.0.13affected
References
- https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21aef493971 ↗
- https://git.kernel.org/stable/c/a2b56627c0d13009e02f6f2c0206c0451ed19a0e ↗
- https://git.kernel.org/stable/c/2572ab14b73aa45b6ae7e4c089ccf119fed5cf89 ↗
- https://git.kernel.org/stable/c/4afc77068e36cee45b39d4fdc7513de26980f72c ↗
- https://git.kernel.org/stable/c/32f01f0306a98629508f84d7ef0d1d037bc274a2 ↗
- https://git.kernel.org/stable/c/6fb8bc29bfa80707994a63cc97e2f9920e0b0608 ↗
- https://git.kernel.org/stable/c/d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3 ↗
- https://git.kernel.org/stable/c/5eef2141776da02772c44ec406d6871a790761ee ↗