CVE-2022-48945

What it actually does

Missing boundary check after adjusting compose->height in V4L2_SEL_TGT_CROP case allows compose size to exceed limits, leading to out-of-bounds write during tpg_fill_plane_buffer in the vivid virtual video driver and a subsequent kernel page fault.

Why it matters to the business

Systems using the vivid driver may experience kernel crashes or denial of service; widespread Linux kernel deployments increase exposure surface for local attackers with access to video capture interfaces.

How an attack unfolds

An attacker with local access crafts a video buffer or selection target that triggers the missing boundary validation after compose height adjustment; this causes memcpy_erms to write beyond allocated pages during vivid_fillbuff, resulting in a kernel oops. The flaw was originally identified via syzkaller fuzzing.

How to fix it

Update the Linux kernel to include commit 8c0ee15d9a102c732d0745566d254040085d5663 which adds the v4l2_rect_map_inside() call for the V4L2_SEL_TGT_CROP case in the vivid driver.

How to confirm the fix worked

Verify the presence of commit 8c0ee15d9a102c732d0745566d254040085d5663 in the kernel source or confirm the kernel version incorporates the boundary check in media/vivid/vivid-vid-cap.c; test with reproduction steps that previously triggered the page fault.

Typical attack path

1. Obtain local access on a system with the vivid driver loaded
2. Open the vivid video capture device and issue V4L2 selection ioctls targeting crop/compose rectangles
3. Manipulate height values to exceed internal buffer boundaries without triggering prior checks
4. Trigger buffer fill operations via vivid_thread_vid_cap to execute the unbounded memcpy
5. Cause kernel page fault and potential system instability or crash

How to detect it

Review kernel logs for page faults or oops messages referencing memcpy_erms, tpg_fill_plane_buffer, vivid_fillbuff, or vivid_thread_vid_cap; correlate with processes interacting with /dev/video* devices backed by vivid.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all systems exposing the vivid driver
• Disable or remove the vivid module if virtual video testing is not required
• Monitor for kernel oops reports involving tpg_fill_plane_buffer or vivid_fillbuff