LiveActive security incident?Get immediate response
CVE Record

CVE-2025-23159: media: venus: hfi: add a check to handle OOB in sfr region

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared memory and can be modified by malicious user. OOB write is possible when the size is made higher than actual sfr data buffer. Cap the size to allocated size for such cases.

HighCVSS 8.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local attacker could manipulate a shared-memory size value used by Linux’s Venus media driver, causing data to be written beyond its allocated buffer. This may crash the system or corrupt kernel memory, potentially affecting confidentiality, integrity, and availability. The supplied CVSS score is 8.4.

Executive priority

Treat this as a high-priority, exposure-dependent kernel update. Accelerate remediation on multi-user or otherwise untrusted systems using the Venus media path. Systems without this driver are less likely to be exposed, but should not be declared unaffected without configuration and vendor verification.

Technical view

The Venus HFI code trusted sfr->buf_size from shared memory. A malicious user could increase that value beyond the allocated SFR data-buffer size, producing an out-of-bounds write. The Linux stable fix caps the shared value to the allocated size before use.

Likely exposure

Exposure is limited to Linux systems containing the affected Venus HFI media code. The supplied data lists Linux 4.13 and multiple 5.x and 6.x releases, but does not provide reliable affected ranges. Confirm exposure through kernel configuration, active driver use, and vendor backport status.

Exploitation context

The CVSS vector describes local, low-complexity exploitation requiring no privileges or user interaction, with potentially high impact across confidentiality, integrity, and availability. The bundle reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit.

Researcher notes

The record identifies an out-of-bounds write but supplies no CWE. Its version data appears flattened or incomplete, so commit and vendor-package analysis is more dependable than version-string comparison. Multiple stable commits indicate branch-specific backports. No source in the bundle establishes exploit availability or exploitation in the wild.

Mitigation direction

  • Install a vendor-supported kernel containing the fix that caps sfr->buf_size to the allocated size.
  • Confirm vendor backport status instead of relying solely on the reported kernel version.
  • Prioritize systems where the Venus HFI driver is enabled and accessible to untrusted local users.
  • If updates are unavailable, consult Linux distribution or device-vendor guidance for supported mitigations.
  • Reduce untrusted local access on exposed systems until the corrected kernel is installed.

Validation and detection

  • Inventory deployed kernel builds, package revisions, and vendor security-update status.
  • Determine whether the Venus HFI media driver is built, loaded, or used on each system.
  • Compare kernel source or package changelogs with the applicable cited stable fix commit.
  • Verify the installed update includes the buffer-size cap or an equivalent vendor backport.
  • Test normal media workloads after remediation and monitor kernel logs for regressions.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-23159 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
12Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.4CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.55.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.4High
CVSS 3.1 vector shape for CVE-2025-23159Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fb, d96d3f30c0f2f564f6922bf4ccdf4464992e31fbunaffected
LinuxLinux4.13, 0, 5.4.293, 5.10.237, 5.15.181, 6.1.135, 6.6.88, 6.12.24, 6.13.12, 6.14.3, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.