Description
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 1b86c1917e16bafbbb08ab90baaff533aa36c62daffectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < a45957bcde529169188929816775a575de77d84faffectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 32af5c1fdb9bc274f52ee0472d3b060b18e4aab4affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 40084302f639b3fe954398c5ba5ee556b7242b54affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 679424f8b31446f90080befd0300ea915485b096affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < edb89d69b1438681daaf5ca90aed3242df94cc96affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 101a86619aab42bb61f2253bbf720121022eab86affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 69baf245b23e20efda0079238b27fc63ecf13de1affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.4.293 to ≤ 5.4.*unaffected5.10.237 to ≤ 5.10.*unaffected5.15.181 to ≤ 5.15.*unaffected6.1.135 to ≤ 6.1.*unaffected6.6.88 to ≤ 6.6.*unaffected6.12.24 to ≤ 6.12.*unaffected6.13.12 to ≤ 6.13.*unaffected6.14.3 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d ↗
- https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f ↗
- https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4 ↗
- https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75 ↗
- https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54 ↗
- https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096 ↗
- https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96 ↗
- https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86 ↗
- https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1 ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗