159 lines
8.9 KiB
JSON
159 lines
8.9 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-53748",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-08T01:18:04.279Z",
|
|
"datePublished": "2025-12-08T01:19:07.318Z",
|
|
"dateUpdated": "2026-08-05T09:15:46.862Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T09:15:46.862Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup\n\nvariable *nplanes is provided by user via system call argument. The\npossible value of q_data->fmt->num_planes is 1-3, while the value\nof *nplanes can be 1-8. The array access by index i can cause array\nout-of-bounds.\n\nFix this bug by checking *nplanes against the array size."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
|
|
"baseScore": 7.1,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only through `ioctl(VIDIOC_CREATE_BUFS)` on the MediaTek decoder character device `/dev/videoN`, which requires local system access. There is no network or remote data path into `vb2ops_vdec_queue_setup()`.\nAC:L - Both `*nplanes` (up to VIDEO_MAX_PLANES=8) and every `sizes[i]` come directly from the caller's `v4l2_create_buffers` structure, so the out-of-bounds read is triggered deterministically on the first ioctl with no race, no timing window, and no dependence on memory layout the attacker cannot influence.\nPR:L - No capability check exists anywhere on the path — only `open()` on the V4L2 decoder node, which is granted to the `video` group on ChromeOS MediaTek devices and to the mediacodec/media domain on Android. A local unprivileged account or a compromised media-codec/GPU sandbox process suffices.\nUI:N - The attacker performs `open()` plus `VIDIOC_CREATE_BUFS` entirely on their own file descriptor. No victim action, no privileged helper, and no pre-existing system state are required.\nS:U - The out-of-bounds access is confined to the kernel's own heap object (`struct mtk_vcodec_ctx`) and the impact stays within the kernel security authority. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The `sizes[i] < q_data->sizeimage[i]` comparison is an attacker-controlled oracle over out-of-bounds memory, letting the `const struct mtk_video_fmt *fmt` kernel-image pointer at offset 48 be recovered bit-by-bit via binary search — a reliable KASLR/kernel-base disclosure that is the standard enabling primitive for a full local privilege-escalation chain.\nI:N - The loop only reads `q_data->sizeimage[i]`; `sizes[]` is `VB2_MAX_PLANES`-sized and the writing `else` branch is bounded by `fmt->num_planes <= 3`, so there is no out-of-bounds write or other modification of kernel data.\nA:H - The out-of-bounds index into the fixed three-element `sizeimage[]` array is precisely what `CONFIG_UBSAN_BOUNDS` instruments, so on the hardened Android GKI and arm64 configurations where this MediaTek codec driver actually ships, `CONFIG_UBSAN_TRAP` turns each attacker-issued ioctl into a kernel panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc",
|
|
"lessThan": "48e4e06e2c5fe1fda283d499f91492eda2248bb9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc",
|
|
"lessThan": "b8e19bf3b4aebd855be01b64674187dcf6d1db51",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "590577a4e5257ac3ed72999a94666ad6ba8f24bc",
|
|
"lessThan": "8fbcf730cb89c3647f3365226fe7014118fa93c7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.10",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.10",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.30",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.4",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.10",
|
|
"versionEndExcluding": "6.1.30"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.10",
|
|
"versionEndExcluding": "6.3.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.10",
|
|
"versionEndExcluding": "6.4"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/48e4e06e2c5fe1fda283d499f91492eda2248bb9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b8e19bf3b4aebd855be01b64674187dcf6d1db51"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8fbcf730cb89c3647f3365226fe7014118fa93c7"
|
|
}
|
|
],
|
|
"title": "media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |