Description
In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity prepare_tile_info_buffer() writes one entry per tile into the tile_sizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded v4l2_hevc_pps_num_tile_columns() / v4l2_hevc_pps_num_tile_rows() helpers so the loops stay inside the buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 6d192fc0d6faff25ecf6d52cbde4b939cb12c192affectedcb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 2887a98c03d97a6fcb6c2dab92956f2f4c402cddaffectedcb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 62ae24639d22909a5724627a0467e4bde9704020affectedcb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 4f654c9bc954569ff9b8ab860b29480c4cf6f57baffectedcb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8affectedcb5dd5a0fa518dff14ff2b90837c3c8f98f4dd5c to < 06236b094c899c22c12ac5097935eb6719293de8affected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6d192fc0d6faff25ecf6d52cbde4b939cb12c192 ↗
- https://git.kernel.org/stable/c/2887a98c03d97a6fcb6c2dab92956f2f4c402cdd ↗
- https://git.kernel.org/stable/c/62ae24639d22909a5724627a0467e4bde9704020 ↗
- https://git.kernel.org/stable/c/4f654c9bc954569ff9b8ab860b29480c4cf6f57b ↗
- https://git.kernel.org/stable/c/05e8e4cdfe692f5cedba9aa9d7b8f2584cf926c8 ↗
- https://git.kernel.org/stable/c/06236b094c899c22c12ac5097935eb6719293de8 ↗