Linux Kernel Out-of-Bounds Write Vulnerability in Venus Media Component

An out-of-bounds write vulnerability has been identified in the Linux kernel's Venus media component, specifically within the HFI (Hardware Frame Interface) handling. The issue arises because the 'buf_size' parameter, located in shared memory, can be manipulated by a malicious user. This manipulation allows for an out-of-bounds write when the specified size exceeds the actual data buffer allocated for the SFR (Streaming Frame Rate) region. The vulnerability has been addressed by adding a check to ensure that the size does not exceed the allocated buffer capacity.

Impact

Exploitation of this vulnerability could lead to arbitrary memory writes, potentially causing memory corruption or allowing for the execution of arbitrary code.