media: v4l2-dv-timings.c: fix too strict blanking sanity checks (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.25 % · percentile 16 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-dv-timings.c: fix too strict blanking sanity checks Sanity checks were added to verify the v4l2_bt_timings blanking fields in order to avoid integer overflows when userspace passes weird values. But that assumed that userspace would correctly fill in the front porch, backporch and sync values, but sometimes all you know is the total blanking, which is then assigned to just one of these fields. And that can fail with these checks. So instead set a maximum for the total horizontal and vertical blanking and check that each field remains below that. That is still sufficient to avoid integer overflows, but it also allows for more flexibility in how userspace fills in these fields.
Weaknesses (CWE)
- CWE-190 — Integer Overflow or Wraparound
References
- https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21aef493971
- https://git.kernel.org/stable/c/a2b56627c0d13009e02f6f2c0206c0451ed19a0e
- https://git.kernel.org/stable/c/2572ab14b73aa45b6ae7e4c089ccf119fed5cf89
- https://git.kernel.org/stable/c/4afc77068e36cee45b39d4fdc7513de26980f72c
- https://git.kernel.org/stable/c/32f01f0306a98629508f84d7ef0d1d037bc274a2
- https://git.kernel.org/stable/c/6fb8bc29bfa80707994a63cc97e2f9920e0b0608
- https://git.kernel.org/stable/c/d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3
- https://git.kernel.org/stable/c/5eef2141776da02772c44ec406d6871a790761ee
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2022-53866
- GCVE · GCVE-0-2022-48987
CERT-FR advisories
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1033 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.332 < 4.9.336cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.298 < 4.14.302cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.264 < 4.19.269cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.226 < 5.4.227cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.153 < 5.10.159cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.77 < 5.15.83cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.0.7 < 6.0.13
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 15ded23db134da975b49ea99770de0346c193b24 < 0d73b49c4037199472b29574ae21c21aef493971 ; affected 3d43b2b8a3cdadd6cef9ac8ef5d156b6214a01c8 < a2b56627c0d13009e02f6f2c0206c0451ed19a0e ; affected 9cf9211635b68e8e0c8cb88d43ca7dc83e4632aa < 2572ab14b73aa45b6ae7e4c089ccf119fed5cf89 ; affected b4a3a01762ae072c7f6ff2ff53b5019761288346 < 4afc77068e36cee45b39d4fdc7513de26980f72c ; affected 683015ae163481457a16fad2317af66360dc4762 < 32f01f0306a98629508f84d7ef0d1d037bc274a2 ; affected 491c0959f01d87bcbd5a1498bc70e0a3382c65a8 < 6fb8bc29bfa80707994a63cc97e2f9920e0b0608 |
| Linux · Linux | affected 4.9.332 < 4.9.336 ; affected 4.14.298 < 4.14.302 ; affected 4.19.264 < 4.19.269 ; affected 5.4.223 < 5.4.227 ; affected 5.10.153 < 5.10.159 ; affected 5.15.77 < 5.15.83 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |