Description
In the Linux kernel, the following vulnerability has been resolved: media: s2255: bound JPEG frame size before copying into the buffer s2255_fillbuff() memcpy()s vc->jpg_size bytes of a captured JPEG/MJPEG frame into the vb2 plane. vc->jpg_size is taken verbatim from the S2255_MARKER_FRAME header the device sends (pdword[4] in save_frame()) and, unlike the frame payload length just above it, is never bounded: payload = le32_to_cpu(pdword[3]); if (payload > vc->req_image_size) /* payload is checked ... */ return -EINVAL; vc->pkt_size = payload; vc->jpg_size = le32_to_cpu(pdword[4]); /* ... jpg_size is not */ A malicious or malfunctioning device can therefore report a jpg_size larger than the destination vb2 plane, and the memcpy() writes past it. jpg_size is a signed int, so a value with the top bit set also turns into a huge length. Reject a frame whose jpg_size is negative or exceeds the plane size before copying it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < 32a595dd3e8634544e5cfbc47f906dff3d3c1ef8affected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < 4b6f7bccc6559ae5c54573c284fe76eafc9989b2affected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < 2542516a147bfad740e7e411c251b639fad260ffaffected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < 79f58f900dd221ab04ea74bf4eaf79fa3b0fcc77affected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < d2ecaaab6a4f165abb54cdf61be60030b5782bf8affected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < 68d664f1b4efe525e99154b7058fcb0378bdaff7affected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < dd739517560c8d0ec4463a53e717bf40b988d7daaffected38f993ad8b1fe4caf9e989caf6e2a25aff3bbaf7 to < e504cc888f42999dd76b6a43788c422610f2aad2affected
Linux Linux
Default version status: affected
2.6.27affected0 to < 2.6.27unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/32a595dd3e8634544e5cfbc47f906dff3d3c1ef8 ↗
- https://git.kernel.org/stable/c/4b6f7bccc6559ae5c54573c284fe76eafc9989b2 ↗
- https://git.kernel.org/stable/c/2542516a147bfad740e7e411c251b639fad260ff ↗
- https://git.kernel.org/stable/c/79f58f900dd221ab04ea74bf4eaf79fa3b0fcc77 ↗
- https://git.kernel.org/stable/c/d2ecaaab6a4f165abb54cdf61be60030b5782bf8 ↗
- https://git.kernel.org/stable/c/68d664f1b4efe525e99154b7058fcb0378bdaff7 ↗
- https://git.kernel.org/stable/c/dd739517560c8d0ec4463a53e717bf40b988d7da ↗
- https://git.kernel.org/stable/c/e504cc888f42999dd76b6a43788c422610f2aad2 ↗