| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48987: media: v4l2-dv-timings.c: fix too strict blanking sanity checks |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| media: v4l2-dv-timings.c: fix too strict blanking sanity checks |
| |
| Sanity checks were added to verify the v4l2_bt_timings blanking fields |
| in order to avoid integer overflows when userspace passes weird values. |
| |
| But that assumed that userspace would correctly fill in the front porch, |
| backporch and sync values, but sometimes all you know is the total |
| blanking, which is then assigned to just one of these fields. |
| |
| And that can fail with these checks. |
| |
| So instead set a maximum for the total horizontal and vertical |
| blanking and check that each field remains below that. |
| |
| That is still sufficient to avoid integer overflows, but it also |
| allows for more flexibility in how userspace fills in these fields. |
| |
| The Linux kernel CVE team has assigned CVE-2022-48987 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.9.332 with commit 15ded23db134da975b49ea99770de0346c193b24 and fixed in 4.9.336 with commit 0d73b49c4037199472b29574ae21c21aef493971 |
| Issue introduced in 4.14.298 with commit 3d43b2b8a3cdadd6cef9ac8ef5d156b6214a01c8 and fixed in 4.14.302 with commit a2b56627c0d13009e02f6f2c0206c0451ed19a0e |
| Issue introduced in 4.19.264 with commit 9cf9211635b68e8e0c8cb88d43ca7dc83e4632aa and fixed in 4.19.269 with commit 2572ab14b73aa45b6ae7e4c089ccf119fed5cf89 |
| Issue introduced in 5.4.223 with commit b4a3a01762ae072c7f6ff2ff53b5019761288346 and fixed in 5.4.227 with commit 4afc77068e36cee45b39d4fdc7513de26980f72c |
| Issue introduced in 5.10.153 with commit 683015ae163481457a16fad2317af66360dc4762 and fixed in 5.10.159 with commit 32f01f0306a98629508f84d7ef0d1d037bc274a2 |
| Issue introduced in 5.15.77 with commit 491c0959f01d87bcbd5a1498bc70e0a3382c65a8 and fixed in 5.15.83 with commit 6fb8bc29bfa80707994a63cc97e2f9920e0b0608 |
| Issue introduced in 6.0.7 with commit dc7276c3f6ca008be1faf531f84b49906c9bcf7f and fixed in 6.0.13 with commit d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48987 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/media/v4l2-core/v4l2-dv-timings.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21aef493971 |
| https://git.kernel.org/stable/c/a2b56627c0d13009e02f6f2c0206c0451ed19a0e |
| https://git.kernel.org/stable/c/2572ab14b73aa45b6ae7e4c089ccf119fed5cf89 |
| https://git.kernel.org/stable/c/4afc77068e36cee45b39d4fdc7513de26980f72c |
| https://git.kernel.org/stable/c/32f01f0306a98629508f84d7ef0d1d037bc274a2 |
| https://git.kernel.org/stable/c/6fb8bc29bfa80707994a63cc97e2f9920e0b0608 |
| https://git.kernel.org/stable/c/d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3 |
| https://git.kernel.org/stable/c/5eef2141776da02772c44ec406d6871a790761ee |
