Executive brief
A vulnerability in the Linux kernel's Venus video driver could allow a local attacker to cause a system crash or potentially access sensitive memory. The Venus driver is responsible for hardware-accelerated video encoding and decoding on certain hardware platforms. This issue occurs when the system processes data from the hardware's firmware without properly verifying the size of the incoming data packets.
Technical details
An out-of-bounds (OOB) memory access vulnerability exists in the Linux kernel's Venus HFI (Host Firmware Interface) implementation. The root cause is located in 'drivers/media/platform/qcom/venus/hfi_venus.c' within the 'venus_read_queue' function, where the driver fails to validate that the packet size reported in the header matches the actual number of available words in shared memory. A local attacker with low privileges could potentially exploit this to trigger an OOB read or write, leading to a denial of service (kernel panic) or information disclosure. The vulnerability has been addressed by adding a check to ensure the packet header size matches the expected 'dwords' count after reading from shared memory.
Affected products
- Linux Linux Kernel 4.13 to 6.14
- Siemens SIMATIC CN 4100 before V5.0
Timeline
- 2025-05-19: other: Patch authored
- 2025-09-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0520c89f6280d2b60ab537d5743601185ee7d8ab
- https://git.kernel.org/stable/c/2d8cea8310a245730816a1fd0c9fa4a5a3bdc68c
- https://git.kernel.org/stable/c/49befc830daa743e051a65468c05c2ff9e8580e6
- https://git.kernel.org/stable/c/7638bae4539dcebc3f68fda74ac35d73618ec440
- https://git.kernel.org/stable/c/ba567c2e52fbcf0e20502746bdaa79e911c2e8cf
- https://git.kernel.org/stable/c/ef09b96665f16f3f0bac4e111160e6f24f1f8791
- https://git.kernel.org/stable/c/f0cbd9386f974d310a0d20a02e4a1323e95ea654