142 lines
8.4 KiB
JSON
142 lines
8.4 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-97580",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-24T16:01:01.156Z",
|
|
"datePublished": "2026-09-25T10:22:01.832Z",
|
|
"dateUpdated": "2026-10-19T09:09:42.749Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:09:42.749Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rkvdec: bound HEVC tile loops and PPS id to the array capacity\n\ncompute_tiles_uniform() and compute_tiles_non_uniform() loop over\nnum_tile_columns_minus1 + 1 / num_tile_rows_minus1 + 1 entries, and\nassemble_hw_pps() writes one COLUMN_WIDTH / ROW_HEIGHT register per tile\nand indexes priv_tbl->param_set[] by pic_parameter_set_id, all taken from\nthe untrusted PPS. Use the bounded v4l2_hevc_pps_num_tile_columns() /\nv4l2_hevc_pps_num_tile_rows() helpers for the tile loops, and bail out of\nassemble_hw_pps() before indexing priv_tbl->param_set[] with an\nout-of-range pic_parameter_set_id, so the writes stay within the hardware\ntables."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bad values are fields of the V4L2_CID_STATELESS_HEVC_PPS control, which a local process sets with VIDIOC_S_EXT_CTRLS on the rkvdec /dev/videoN node. rkvdec_hevc_run() then passes them to assemble_hw_pps() and compute_tiles_*(). No network protocol delivers these fields to the kernel; a userspace bitstream parser sits in between.\nAC:L - std_validate_compound() never range-checks num_tile_columns_minus1, num_tile_rows_minus1 or pic_parameter_set_id, all u8 values up to 255. The attacker sets TILES_ENABLED with a value above 19, or pic_parameter_set_id of 64 or more, queues a decode request, and the out-of-bounds write happens every time.\nPR:L - rkvdec_open() and the stateless control and request ioctls have no capability checks. The attacker needs only ordinary access to the decoder device node, such as video group membership or a media service context.\nUI:N - The attacker supplies the malicious PPS control and triggers the decode job alone. No other user has to do anything.\nS:U - This is memory corruption inside the kernel, reached from a local process. The impact stays within the kernel's own security authority; no VM or IOMMU boundary is crossed.\nC:H - In rkvdec-vdpu381-hevc.c, assemble_hw_pps() lets compute_tiles_uniform()/compute_tiles_non_uniform() write up to 256 u16 entries into the 20- and 22-entry arrays column_width[] and row_height[] on the kernel stack. The non-uniform path also reads past pps->column_width_minus1[]. Stack corruption like this can be used to leak kernel memory.\nI:H - The loops overwrite the stack past column_width[20]/row_height[22] with values derived from attacker-set PPS and SPS fields. Separately, param_set[pic_parameter_set_id] with an id of 64 or more, and the COLUMN_WIDTH(i)/ROW_HEIGHT(i) WRITE_PPS loop, write outside the intended hardware tables. Both are out-of-bounds kernel writes.\nA:H - Overflowing the column_width/row_height arrays on the stack trips the stack protector or corrupts saved state, which causes a kernel panic or oops. The attacker can trigger it again with every queued decode request."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c",
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c",
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3595375c2301653d5440d54b396df03499686c20",
|
|
"lessThan": "03beb248d8a7bab30559a60d4df81f167e63b9e3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3595375c2301653d5440d54b396df03499686c20",
|
|
"lessThan": "81ad46bb33d8fd279aaa33af5296c648814c964b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-hevc-common.c",
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-hevc.c",
|
|
"drivers/media/platform/rockchip/rkvdec/rkvdec-vdpu381-hevc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.19",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.19",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.7",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.19",
|
|
"versionEndExcluding": "7.2.7"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.19",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/03beb248d8a7bab30559a60d4df81f167e63b9e3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/81ad46bb33d8fd279aaa33af5296c648814c964b"
|
|
}
|
|
],
|
|
"title": "media: rkvdec: bound HEVC tile loops and PPS id to the array capacity",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |