Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tile_info.tile_cols and tile_rows as loop bounds and as indices into the mi_*_starts[] and *_in_sbs_minus_1[] arrays, as the divisor for context_update_tile_id, and their product bounds the per-tile descriptor buffers, but std_validate_compound() does not bound these u8 fields. Reject a V4L2_CTRL_TYPE_AV1_FRAME whose tile_cols or tile_rows exceeds V4L2_AV1_MAX_TILE_COLS / _ROWS, or whose product exceeds V4L2_AV1_MAX_TILE_COUNT. A zero tile count is left to the consuming driver so the zero-initialised control that existing userspace submits is still accepted.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9de30f579980b498606a9c2440b73ae3b670771b to < 1afaf85c4990fb1e3168d0d6e99246a65e526f1baffected9de30f579980b498606a9c2440b73ae3b670771b to < 85df9fc79b07f1cc7c953f930ae7e675d0c1e820affected9de30f579980b498606a9c2440b73ae3b670771b to < c8891da0186fe4c04bccbbd7d84b01a3c941ac7aaffected9de30f579980b498606a9c2440b73ae3b670771b to < c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8affected9de30f579980b498606a9c2440b73ae3b670771b to < 439058ced617fbb3febc017b9e93bb7387f309e0affected
Linux Linux
Default version status: affected
6.5affected0 to < 6.5unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1afaf85c4990fb1e3168d0d6e99246a65e526f1b ↗
- https://git.kernel.org/stable/c/85df9fc79b07f1cc7c953f930ae7e675d0c1e820 ↗
- https://git.kernel.org/stable/c/c8891da0186fe4c04bccbbd7d84b01a3c941ac7a ↗
- https://git.kernel.org/stable/c/c4c88b5ba85685043d171e0e9c9d00a8cf6a89e8 ↗
- https://git.kernel.org/stable/c/439058ced617fbb3febc017b9e93bb7387f309e0 ↗