CVE-2025-21996

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-21996
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and first command to execute is to encode (case 0x03000001), the function in question will attempt to call radeon_vce_cs_reloc() with size argument that has not been properly initialized. Specifically, 'size' will point to 'tmp' variable before the latter had a chance to be assigned any value. Play it safe and init 'tmp' with 0, thus ensuring that radeon_vce_cs_reloc() will catch an early error in cases like these. Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE. (cherry picked from commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 Patch
https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 Patch
https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d Patch
https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 Patch
https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 Patch
https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 Patch
https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c Patch
https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
History

14 Apr 2025, 12:31

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 - () https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 - Patch
References () https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 - () https://git.kernel.org/stable/c/3ce08215cad55c10a6eeeb33d3583b6cfffe3ab8 - Patch
References () https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d - () https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d - Patch
References () https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 - () https://git.kernel.org/stable/c/78b07dada3f02f77762d0755a96d35f53b02be69 - Patch
References () https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 - () https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 - Patch
References () https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 - () https://git.kernel.org/stable/c/dd1801aa01bba1760357f2a641346ae149686713 - Patch
References () https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c - () https://git.kernel.org/stable/c/dd8689b52a24807c2d5ce0a17cb26dc87f75235c - Patch
References () https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8 - () https://git.kernel.org/stable/c/f5e049028124f755283f2c07e7a3708361ed1dc8 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.14:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-908

10 Apr 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/0effb378ebce52b897f85cd7f828854b8c7cb636 -
  • () https://git.kernel.org/stable/c/5b4d9d20fd455a97920cf158dd19163b879cf65d -
  • () https://git.kernel.org/stable/c/9b2da9c673a0da1359a2151f7ce773e2f77d71a9 -

07 Apr 2025, 14:18

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/radeon: soluciona el problema de tamaño no inicializado en radeon_vce_cs_parse() En el improbable caso de que el flujo de comandos pasado desde el espacio de usuario a través de la llamada ioctl() a radeon_vce_cs_parse() esté manipulado de forma extraña y el primer comando a ejecutar sea codificar (caso 0x03000001), la función en cuestión intentará llamar a radeon_vce_cs_reloc() con el argumento de tamaño que no se ha inicializado correctamente. Específicamente, 'size' apuntará a la variable 'tmp' antes de que a esta última se le haya asignado algún valor. Vaya a lo seguro e inicialice 'tmp' con 0, lo que garantiza que radeon_vce_cs_reloc() detecte un error temprano en casos como estos. Encontrado por el Centro de Verificación de Linux (linuxtesting.org) con la herramienta de análisis estático SVACE. (seleccionado del commit 2d52de55f9ee7aaee0e09ac443f77855989c6b68)

03 Apr 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-03 08:15

Updated : 2025-04-14 12:31

NVD link : CVE-2025-21996

Mitre link : CVE-2025-21996

CVE.ORG link : CVE-2025-21996

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource