222 lines
12 KiB
JSON
222 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-43256",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-01T14:12:55.996Z",
|
|
"datePublished": "2026-05-06T11:28:45.209Z",
|
|
"dateUpdated": "2026-08-05T12:26:55.873Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:26:55.873Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()\n\nvfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop\nbound and passes the index to vfe_isr_reg_update(). However,\nvfe->line[] array is defined with VFE_LINE_NUM_MAX(4):\n\n struct vfe_line line[VFE_LINE_NUM_MAX];\n\nWhen index is 4, 5, 6, the access to vfe->line[line_id] exceeds\nthe array bounds and resulting in out-of-bounds memory access.\n\nFix this by using separate loops for output lines and write masters."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable path is reached through local V4L2/media device use, where a process starts CAMSS camera streaming and the hardware interrupt enters vfe_isr(). It is not directly network-facing and does not require physical hotplug beyond the affected built-in camera hardware.\nAC:L - On SM8250 VFE-lite, ordinary bus completion bits overlap the erroneous RDI_RUP checks for indices 4-6, so normal streaming interrupts can pass out-of-bounds line IDs. No race or condition outside the attacker's control is required once streaming is active.\nPR:L - The driver has no capable() or administrator-only check on this path; access is governed by V4L2 device-node or camera-service permissions. This is basic local privilege, not real root in the init namespace.\nUI:N - A malicious local process with access to the camera device can configure buffers and start streaming itself. No separate victim action is required.\nS:U - The impact remains within the kernel/CAMSS security authority. There is no guest-to-host, IOMMU, or other cross-scope boundary bypass.\nC:H - The bug performs out-of-bounds reads from kernel memory beyond vfe->line[]. Because this is repeatable kernel memory corruption, high confidentiality impact is defensible.\nI:H - If the out-of-bounds wait_reg_update field is nonzero, the ISR writes to out-of-bounds memory and calls complete() on an out-of-bounds completion object. This can corrupt adjacent kernel objects, so integrity impact is high.\nA:H - The out-of-bounds access and possible complete() on invalid memory occur in interrupt context and can cause an oops or panic. The trigger can be repeated by restarting or continuing camera streaming."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/qcom/camss/camss-vfe-480.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "0c074e80921fd18984b75836730d76c768c84f65",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "1b103307df6d461a0731be25aca69ad0335b0933",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "fade67c88870f497a13ed450ba01f7236c92dd9b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "e7a38ecda2498e7ce998793ac2a46ca47317635d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
|
|
"lessThan": "d965919af524e68cb2ab1a685872050ad2ee933d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/qcom/camss/camss-vfe-480.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.18",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.18",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.167",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.128",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.75",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.16",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.6",
|
|
"lessThanOrEqual": "6.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "6.1.167"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "6.6.128"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "6.12.75"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "6.18.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "6.19.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.18",
|
|
"versionEndExcluding": "7.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0c074e80921fd18984b75836730d76c768c84f65"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1b103307df6d461a0731be25aca69ad0335b0933"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fade67c88870f497a13ed450ba01f7236c92dd9b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e7a38ecda2498e7ce998793ac2a46ca47317635d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d965919af524e68cb2ab1a685872050ad2ee933d"
|
|
}
|
|
],
|
|
"title": "media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |