Executive brief
The AV7110 media driver in the Linux kernel had an integer underflow vulnerability in its video/audio stream decoder component. An attacker with access to the ts_play() interface could supply malicious data that causes a negative length value to be passed to internal functions, potentially leading to memory corruption or denial of service.
Technical details
The vulnerability is an integer underflow in the write_ts_to_decoder() function within the AV7110 DVB-TTPCI media driver. The function calculates a length as "len - (buf[4] + 1) - 4", where buf[4] is a user-controlled u8 value received via the ts_play() ioctl. Without proper bounds checking, a large buf[4] value could result in a negative length being passed to av7110_ipack_instant_repack(). The fix adds a check to ensure buf[4] does not exceed len - 5 before performing the length calculation. The vulnerability is reachable via ioctl interface and requires local access.
Affected products
- Linux Linux kernel multiple versions; fix applied to stable series
Timeline
- 2025-12-30: disclosed
- 2023-03-07: patched: Fix committed upstream
- 2023-05-11: patched: Patch backported to stable kernels