Description
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchip_vpu981_av1_dec_set_tile_info() divides context_update_tile_id by tile_info->tile_cols and writes one descriptor per tile into the tile_info DMA buffer, which holds AV1_MAX_TILES entries; tile_cols and tile_rows come from the bitstream. Guard the division against a zero tile_cols by initialising the context-update values to zero and computing them only when tile_cols is non-zero, and stop the descriptor writes once the tile_info buffer is full. The tile geometry written to the hardware registers is left unmodified; the per-dimension and total tile bounds are enforced by the control validation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
727a400686a2c0d25015c9e44916a59b72882f83 to < 8659e5fc21a82e00fb2db1557f2e06f0fca06b90affected727a400686a2c0d25015c9e44916a59b72882f83 to < 7baa7bb1b784c19170df8c99466fa412040eb431affected727a400686a2c0d25015c9e44916a59b72882f83 to < 8f19d869a9f6800547c9ad7ebaf3b94f973dab50affected727a400686a2c0d25015c9e44916a59b72882f83 to < 6b7a281a815ae7c5e7bb2aad039ffea9bc933157affected727a400686a2c0d25015c9e44916a59b72882f83 to < b84f6533a8ed2fd7b282fc7ab4b8efadc745a89caffected
Linux Linux
Default version status: affected
6.5affected0 to < 6.5unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8659e5fc21a82e00fb2db1557f2e06f0fca06b90 ↗
- https://git.kernel.org/stable/c/7baa7bb1b784c19170df8c99466fa412040eb431 ↗
- https://git.kernel.org/stable/c/8f19d869a9f6800547c9ad7ebaf3b94f973dab50 ↗
- https://git.kernel.org/stable/c/6b7a281a815ae7c5e7bb2aad039ffea9bc933157 ↗
- https://git.kernel.org/stable/c/b84f6533a8ed2fd7b282fc7ab4b8efadc745a89c ↗