In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: cx231xx: reject geometry changes while the VBI queue is busy<\/p>\n
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wide
\ndev->width \/ dev->norm but only refuse the change when the *video* queue
\n(dev->vidq) is busy. The VBI queue (dev->vbiq) shares that same geometry:
\ncx231xx_init_vbi_isoc() latches dma_q->lines_per_field from dev->norm,
\nthe VBI videobuf2 plane is sized from dev->width \/ dev->norm in
\nvbi_queue_setup() and vbi_buf_prepare(), and cx231xx_do_vbi_copy() then
\nrecomputes the destination offset from the *live* dev->width and the
\nlatched lines_per_field on every URB completion:<\/p>\n
\toffset = lines_completed * (dev->width <current_field == 2)
\n\t\toffset += dev->width * 2 * dma_q->lines_per_field;
\n\tmemcpy(plane + offset, p_buffer, lencopy);<\/p>\n
Because the VBI node shares video_ioctl_ops with the video node, an
\napplication can size a small VBI plane (REQBUFS\/QBUF with a small width,
\nor with the NTSC standard), then enlarge dev->width (or switch dev->norm
\nto PAL) through the video node while the VBI stream is running — the
\nchange is allowed because only dev->vidq is checked — and let the device
\ndeliver a field-2 VBI payload. cx231xx_do_vbi_copy() now computes the
\noffset with the larger geometry and memcpy()s past the end of the smaller
\nplane that was already allocated, a heap out-of-bounds write whose offset
\nis attacker-chosen and whose contents come from the device. The
\nper-field guard in cx231xx_copy_vbi_line() does not help: it bounds the
\ncopy against the latched lines_per_field, not the plane’s real capacity,
\nand vb2 does not re-run buf_prepare() for an already prepared buffer.<\/p>\n
Refuse the format\/standard change when the VBI queue is busy as well, so
\nthe geometry cannot change underneath an allocated VBI buffer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
media: cx231xx: reject geometry changes while the VBI queue is busy<\/p>\n
vidioc_s_fmt_vid_cap() and vidioc_s_std() change the device-wi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24581","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}