| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()\n\nOn the off chance that command stream passed from userspace via\nioctl() call to radeon_vce_cs_parse() is weirdly crafted and\nfirst command to execute is to encode (case 0x03000001), the function\nin question will attempt to call radeon_vce_cs_reloc() with size\nargument that has not been properly initialized. Specifically, 'size'\nwill point to 'tmp' variable before the latter had a chance to be\nassigned any value.\n\nPlay it safe and init 'tmp' with 0, thus ensuring that\nradeon_vce_cs_reloc() will catch an early error in cases like these.\n\nFound by Linux Verification Center (linuxtesting.org) with static\nanalysis tool SVACE.\n\n(cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)" |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/gpu/drm/radeon/radeon_vce.c" |
| ], |
| "versions": [ |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "0effb378ebce52b897f85cd7f828854b8c7cb636", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "5b4d9d20fd455a97920cf158dd19163b879cf65d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "9b2da9c673a0da1359a2151f7ce773e2f77d71a9", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "78b07dada3f02f77762d0755a96d35f53b02be69", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "dd1801aa01bba1760357f2a641346ae149686713", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "f5e049028124f755283f2c07e7a3708361ed1dc8", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "2fc5703abda201f138faf63bdca743d04dbf4b1a", |
| "lessThan": "dd8689b52a24807c2d5ce0a17cb26dc87f75235c", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/gpu/drm/radeon/radeon_vce.c" |
| ], |
| "versions": [ |
| { |
| "version": "3.15", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "3.15", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.4.292", |
| "lessThanOrEqual": "5.4.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.236", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.180", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.132", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.85", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12.21", |
| "lessThanOrEqual": "6.12.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.13.9", |
| "lessThanOrEqual": "6.13.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.14", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "5.4.292" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "5.10.236" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "5.15.180" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "6.1.132" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "6.6.85" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "6.12.21" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "6.13.9" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "3.15", |
| "versionEndExcluding": "6.14" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c" |
| } |
| ], |
| "title": "drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2025-21996", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
