{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-23156", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-01-11T14:28:41.514Z", "datePublished": "2025-05-01T12:55:42.545Z", "dateUpdated": "2026-08-05T11:57:07.196Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:57:07.196Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi_parser: refactor hfi packet parsing logic\n\nwords_count denotes the number of words in total payload, while data\npoints to payload of various property within it. When words_count\nreaches last word, data can access memory beyond the total payload. This\ncan lead to OOB access. With this patch, the utility api for handling\nindividual properties now returns the size of data consumed. Accordingly\nremaining bytes are calculated before parsing the payload, thereby\neliminates the OOB access possibilities." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The malformed payload arrives from the Venus video firmware over an on-die shared-memory HFI queue, and the kernel-side trigger is local (driver probe, or a local process holding /dev/videoN forcing firmware sys-error recovery); there is no network or adjacent-network path to this component.\nAC:L - The out-of-bounds walk is deterministic — a payload whose last word matches any HFI property tag reliably drives the parser past the buffer end, with no race, timing, or memory-layout condition outside the attacker's control.\nPR:L - An unprivileged local user with access to the video device node (the media/codec service on Android, the `video` group on distros) can repeatedly trigger firmware re-init and re-parse by feeding malformed bitstreams; no root or CAP_SYS_ADMIN is required, matching the PR:L used for the sibling venus firmware-payload CVEs.\nUI:N - Parsing occurs automatically at driver probe and on every firmware recovery cycle, and the attacker's own decode requests drive those cycles — no victim action is needed.\nS:U - The out-of-bounds access is confined to the kernel's own memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The parser reads up to roughly 2.3 KB of adjacent kernel memory (the debug packet buffer and beyond) and copies it into core->caps, whose format tables, profile/level lists, and capability min/max values are subsequently readable by userspace through V4L2 enumeration — a substantial kernel heap information disclosure, far beyond a few bounded bytes.\nI:H - Out-of-bounds data is written into kernel driver state — codec masks, max_sessions_supported, capability limits, and raw-format tables — corrupting the values that govern session limits and buffer/frame sizing decisions for all subsequent video operations.\nA:H - The unbounded forward walk in parse_raw_formats can leave the allocation and dereference unmapped memory, causing a kernel oops, and the corrupted capability state can wedge the video pipeline; any such crash is a full availability loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/qcom/venus/hfi_parser.c" ], "versions": [ { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "0beabe9b49190a02321b02792b29fc0f0e28b51f", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "f195e94c7af921d99abd79f57026a218d191d2c7", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "0f9a4bab7d83738963365372e4745854938eab2d", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "05b07e52a0d08239147ba3460045855f4fb398de", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "bb3fd8b7906a12dc2b61389abb742bf6542d97fb", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "a736c72d476d1c7ca7be5018f2614ee61168ad01", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "6d278c5548d840c4d85d445347b2a5c31b2ab3a0", "status": "affected", "versionType": "git" }, { "version": "1a73374a04e555103e5369429a30999114001dda", "lessThan": "9edaaa8e3e15aab1ca413ab50556de1975bcb329", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/platform/qcom/venus/hfi_parser.c" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.237", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.181", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.135", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.88", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.237" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.135" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.13.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.14.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0beabe9b49190a02321b02792b29fc0f0e28b51f" }, { "url": "https://git.kernel.org/stable/c/f195e94c7af921d99abd79f57026a218d191d2c7" }, { "url": "https://git.kernel.org/stable/c/0f9a4bab7d83738963365372e4745854938eab2d" }, { "url": "https://git.kernel.org/stable/c/05b07e52a0d08239147ba3460045855f4fb398de" }, { "url": "https://git.kernel.org/stable/c/bb3fd8b7906a12dc2b61389abb742bf6542d97fb" }, { "url": "https://git.kernel.org/stable/c/a736c72d476d1c7ca7be5018f2614ee61168ad01" }, { "url": "https://git.kernel.org/stable/c/6d278c5548d840c4d85d445347b2a5c31b2ab3a0" }, { "url": "https://git.kernel.org/stable/c/9edaaa8e3e15aab1ca413ab50556de1975bcb329" } ], "title": "media: venus: hfi_parser: refactor hfi packet parsing logic", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:42:51.136Z" } } ] } }