Description
In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 4dd109038d513b92d4d33524ffc89ba32e02ba48affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 8879397c0da5e5ec1515262995e82cdfd61b282aaffectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 1b8fb257234e7d2d4b3f48af07c5aa5e11c71634affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 4e95233af57715d81830fe82b408c633edff59f4affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 5af611c70fb889d46d2f654b8996746e59556750affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < 530f623f56a6680792499a8404083e17f8ec51f4affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < a062d8de0be5525ec8c52f070acf7607ec8cbfe4affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < d78a8388a27b265fcb2b8d064f088168ac9356b0affectedd96d3f30c0f2f564f6922bf4ccdf4464992e31fb to < f4b211714bcc70effa60c34d9fa613d182e3ef1eaffected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.4.293 to ≤ 5.4.*unaffected5.10.237 to ≤ 5.10.*unaffected5.15.181 to ≤ 5.15.*unaffected6.1.135 to ≤ 6.1.*unaffected6.6.88 to ≤ 6.6.*unaffected6.12.24 to ≤ 6.12.*unaffected6.13.12 to ≤ 6.13.*unaffected6.14.3 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4dd109038d513b92d4d33524ffc89ba32e02ba48 ↗
- https://git.kernel.org/stable/c/8879397c0da5e5ec1515262995e82cdfd61b282a ↗
- https://git.kernel.org/stable/c/1b8fb257234e7d2d4b3f48af07c5aa5e11c71634 ↗
- https://git.kernel.org/stable/c/4e95233af57715d81830fe82b408c633edff59f4 ↗
- https://git.kernel.org/stable/c/5af611c70fb889d46d2f654b8996746e59556750 ↗
- https://git.kernel.org/stable/c/530f623f56a6680792499a8404083e17f8ec51f4 ↗
- https://git.kernel.org/stable/c/a062d8de0be5525ec8c52f070acf7607ec8cbfe4 ↗
- https://git.kernel.org/stable/c/d78a8388a27b265fcb2b8d064f088168ac9356b0 ↗
- https://git.kernel.org/stable/c/f4b211714bcc70effa60c34d9fa613d182e3ef1e ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗