Executive brief
The Linux kernel's MediaTek video decoder component contains an array bounds-checking flaw in its video buffer queue setup function. An attacker with local access to the system can trigger a system call with crafted parameters to read or write beyond the bounds of a kernel memory buffer, potentially leading to information disclosure or denial of service.
Technical details
The vulnerability exists in the vb2ops_vdec_queue_setup() function in drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec.c. The user-supplied *nplanes parameter (range 1–8) is used directly as an array index without validation against the actual array size defined by q_data->fmt->num_planes (range 1–3). This allows an out-of-bounds array access when *nplanes exceeds num_planes. The vulnerability is triggered via a system call that sets up a video buffer queue with invalid plane counts. A patch was applied in commit 8fbcf730cb89c3647f3365226fe7014118fa93c7 (March 2023) that validates *nplanes against the expected array bounds before the loop iteration.
Affected products
- Linux Linux kernel prior to commit 8fbcf730cb89c3647f3365226fe7014118fa93c7 (2023-03-29)
Timeline
- 2025-12-08: disclosed
- 2023-03-29: patched: Upstream patch commit 8fbcf730cb89c3647f3365226fe7014118fa93c7