Riskcovery

CVE-2025-23159

media: venus: hfi: add a check to handle OOB in sfr region

State
Published
Severity
8.4 High
Published
May 1, 2025
Updated
Aug 5, 2026
Reserved
Jan 11, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

media: venus: hfi: add a check to handle OOB in sfr region

sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 4dd109038d513b92d4d33524ffc89ba32e02ba48Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 8879397c0da5e5ec1515262995e82cdfd61b282aAffected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 1b8fb257234e7d2d4b3f48af07c5aa5e11c71634Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 4e95233af57715d81830fe82b408c633edff59f4Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 5af611c70fb889d46d2f654b8996746e59556750Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before 530f623f56a6680792499a8404083e17f8ec51f4Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before a062d8de0be5525ec8c52f070acf7607ec8cbfe4Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before d78a8388a27b265fcb2b8d064f088168ac9356b0Affected
  • d96d3f30c0f2f564f6922bf4ccdf4464992e31fb to before f4b211714bcc70effa60c34d9fa613d182e3ef1eAffected
LinuxLinux
  • 4.13Affected
  • before 4.13Not affected
  • 5.4.293 through 5.4.*Not affected
  • 5.10.237 through 5.10.*Not affected
  • 5.15.181 through 5.15.*Not affected
  • 6.1.135 through 6.1.*Not affected
  • 6.6.88 through 6.6.*Not affected
  • 6.12.24 through 6.12.*Not affected
  • 6.13.12 through 6.13.*Not affected
  • 6.14.3 through 6.14.*Not affected
  • 6.15 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.