| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025090550-CVE-2025-39710-198c@gregkh> Date: Fri, 5 Sep 2025 19:21:23 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-39710: media: venus: Add a check for packet size after reading from shared memory From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access. The Linux kernel CVE team has assigned CVE-2025-39710 to this issue. Affected and fixed versions =========================== Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 5.4.297 with commit 0520c89f6280d2b60ab537d5743601185ee7d8ab Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 5.10.241 with commit f5b7a943055a4a106d40a03bacd940e28cc1955f Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 5.15.190 with commit ef09b96665f16f3f0bac4e111160e6f24f1f8791 Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 6.1.149 with commit 7638bae4539dcebc3f68fda74ac35d73618ec440 Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 6.6.103 with commit ba567c2e52fbcf0e20502746bdaa79e911c2e8cf Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 6.12.44 with commit 2d8cea8310a245730816a1fd0c9fa4a5a3bdc68c Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 6.16.4 with commit f0cbd9386f974d310a0d20a02e4a1323e95ea654 Issue introduced in 4.13 with commit d96d3f30c0f2f564f6922bf4ccdf4464992e31fb and fixed in 6.17-rc1 with commit 49befc830daa743e051a65468c05c2ff9e8580e6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-39710 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/media/platform/qcom/venus/hfi_venus.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/0520c89f6280d2b60ab537d5743601185ee7d8ab https://git.kernel.org/stable/c/f5b7a943055a4a106d40a03bacd940e28cc1955f https://git.kernel.org/stable/c/ef09b96665f16f3f0bac4e111160e6f24f1f8791 https://git.kernel.org/stable/c/7638bae4539dcebc3f68fda74ac35d73618ec440 https://git.kernel.org/stable/c/ba567c2e52fbcf0e20502746bdaa79e911c2e8cf https://git.kernel.org/stable/c/2d8cea8310a245730816a1fd0c9fa4a5a3bdc68c https://git.kernel.org/stable/c/f0cbd9386f974d310a0d20a02e4a1323e95ea654 https://git.kernel.org/stable/c/49befc830daa743e051a65468c05c2ff9e8580e6
Powered by blists - more mailing lists