{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-23158","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-01-11T14:28:41.515Z","datePublished":"2025-05-01T12:55:43.804Z","dateUpdated":"2026-08-05T11:57:09.342Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:57:09.342Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: venus: hfi: add check to handle incorrect queue size\n\nqsize represents size of shared queued between driver and video\nfirmware. Firmware can modify this value to an invalid large value. In\nsuch situation, empty_space will be bigger than the space actually\navailable. Since new_wr_idx is not checked, so the following code will\nresult in an OOB write.\n...\nqsize = qhdr->q_size\n\nif (wr_idx >= rd_idx)\n empty_space = qsize - (wr_idx - rd_idx)\n....\nif (new_wr_idx < qsize) {\n memcpy(wr_ptr, packet, dwords << 2) --> OOB write\n\nAdd check to ensure qsize is within the allocated size while\nreading and writing packets into the queue."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable HFI queue read/write paths are entered through V4L2 device nodes (/dev/videoN) — open(), and encode/decode ioctls that emit HFI commands — plus the driver's own IRQ thread, all requiring local access to the media device. There is no network-facing consumer of this code.\nAC:L - The malicious q_size, read_idx and write_idx are written deterministically into shared memory by the entity the patch models as the adversary; there is no race to win and no memory layout the attacker cannot influence. Repeatedly parking the index just below the end of the queue region makes the overrun reliably reproducible.\nPR:L - Reaching the code needs only an unprivileged process holding an open handle to the venus V4L2 node (Android mediacodec/media HAL, or the `video` group on Linux/automotive builds) — no capability, module-load, or root check exists anywhere on the path.\nUI:N - Triggering requires only opening the video device and driving normal decode/encode traffic; the ISR and debug-queue flush then run automatically with no victim action.\nS:U - Both the vulnerable driver and the corrupted memory belong to the kernel's own security authority, so impact does not cross into a separate authority such as a hypervisor or IOMMU boundary.\nC:H - The read path copies up to 12 KB from a pointer near the end of the last queue, overrunning the DMA allocation by roughly 8 KB into adjacent kernel pages, and that content is then printed via dev_dbg as a %s debug string and parsed as HFI messages — a substantial kernel-memory disclosure.\nI:H - The write path performs an out-of-bounds memcpy past the command-queue region, and the resulting corruption of queue state and message contents is fed straight back into hfi_process_msg_packet(), influencing session state and buffer-done handling; memory corruption of this kind is treated as exploitable for control-flow influence.\nA:H - Out-of-bounds reads past the DMA allocation and out-of-bounds writes readily produce oopses, KASAN-detectable faults, or firmware/driver state corruption that wedges the video pipeline, and the condition can be re-triggered at will."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/qcom/venus/hfi_venus.c"],"versions":[{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"1b86c1917e16bafbbb08ab90baaff533aa36c62d","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"a45957bcde529169188929816775a575de77d84f","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"32af5c1fdb9bc274f52ee0472d3b060b18e4aab4","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"40084302f639b3fe954398c5ba5ee556b7242b54","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"679424f8b31446f90080befd0300ea915485b096","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"edb89d69b1438681daaf5ca90aed3242df94cc96","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"101a86619aab42bb61f2253bbf720121022eab86","status":"affected","versionType":"git"},{"version":"d96d3f30c0f2f564f6922bf4ccdf4464992e31fb","lessThan":"69baf245b23e20efda0079238b27fc63ecf13de1","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/platform/qcom/venus/hfi_venus.c"],"versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","status":"unaffected","versionType":"semver"},{"version":"5.4.293","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.237","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.181","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.135","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.88","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.24","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13.12","lessThanOrEqual":"6.13.*","status":"unaffected","versionType":"semver"},{"version":"6.14.3","lessThanOrEqual":"6.14.*","status":"unaffected","versionType":"semver"},{"version":"6.15","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.4.293"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.10.237"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"5.15.181"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.1.135"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.6.88"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.12.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.13.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.14.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.13","versionEndExcluding":"6.15"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1b86c1917e16bafbbb08ab90baaff533aa36c62d"},{"url":"https://git.kernel.org/stable/c/a45957bcde529169188929816775a575de77d84f"},{"url":"https://git.kernel.org/stable/c/32af5c1fdb9bc274f52ee0472d3b060b18e4aab4"},{"url":"https://git.kernel.org/stable/c/cf5f7bb4e0d786f4d9d50ae6b5963935eab71d75"},{"url":"https://git.kernel.org/stable/c/40084302f639b3fe954398c5ba5ee556b7242b54"},{"url":"https://git.kernel.org/stable/c/679424f8b31446f90080befd0300ea915485b096"},{"url":"https://git.kernel.org/stable/c/edb89d69b1438681daaf5ca90aed3242df94cc96"},{"url":"https://git.kernel.org/stable/c/101a86619aab42bb61f2253bbf720121022eab86"},{"url":"https://git.kernel.org/stable/c/69baf245b23e20efda0079238b27fc63ecf13de1"}],"title":"media: venus: hfi: add check to handle incorrect queue size","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T19:42:56.722Z"}}]}}