Описание
In the Linux kernel, the following vulnerability has been resolved:
media: pci: ivtv: Add check for DMA map result
In case DMA fails, 'dma->SG_length' is 0. This value is later used to
access 'dma->SGarray[dma->SG_length - 1]', which will cause out of
bounds access.
Add check to return early on invalid value. Adjust warnings accordingly.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the event of DMA failure, Linux kernel did not check DMA map result, which could later lead to an out-of-bounds access error.
Отчет
A moderate-impact flaw was found in the Linux kernel's ivtv driver for PCI TV capture cards. When a DMA mapping operation fails, the resulting scatter-gather length (dma->SG_length) of 0 is not validated; that value is later used to index dma->SGarray[dma->SG_length - 1], causing an out-of-bounds kernel memory access. Triggering the issue requires local access with high privileges on a system using ivtv hardware together with a DMA mapping failure, and the practical consequence is a system crash or denial of service. Red Hat therefore rated this flaw Moderate (CVSS 4.4, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), lower than the NIST (7.1) and CVE.org (7.8) scores, which assume lower privileges and confidentiality or integrity impact that Red Hat does not consider realistic for this constrained error path. The vulnerable code was introduced upstream in Linux kernel 5.16, and all Red Hat Enterprise Linux 6, 7, 8, and 9 kernel streams are recorded as not affected because the kernel versions they are based on predate that introducing change. The Fedora kernel is affected, and a fix is being pursued through the community kernel maintenance process (DELEGATED).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a kernel version that contains the upstream fix is the recommended resolution; the fix is included in upstream kernel versions 6.1.103, 6.6.44, 6.10.3, and 6.11-rc1 and later.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: m ...
In the Linux kernel, the following vulnerability has been resolved: media: pci: ivtv: Add check for DMA map result In case DMA fails, 'dma->SG_length' is 0. This value is later used to access 'dma->SGarray[dma->SG_length - 1]', which will cause out of bounds access. Add check to return early on invalid value. Adjust warnings accordingly. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Уязвимость компонента media ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
4.4 Medium
CVSS3