In the Linux kernel, the following vulnerability has been resolved:
media: cec: extron-da-hd-4k-plus: add sanity check
Add check to prevent overflowing msg.msg[] in case the incoming data
is malformed.
CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8
AV:A - extron_process_received() hex-decodes Ceci/Ceco lines the Extron DA HD 4K Plus reports from its HDMI ports over USB-serial; a malicious HDMI-CEC source on the same splitter bus (conference-room laptop, signage player) can supply those frames, with a USB gadget impersonating the Extron only an extra physical path.
AC:L - A crafted Ceci/Ceco line of more than 16 %XX triplets deterministically writes past msg.msg[16]; the attacker fully controls the HDMI-CEC or USB-serial payload, and no race or attacker-uncontrollable memory layout is required.
PR:N - HDMI-CEC and the Extron USB-serial reports are parsed in extron_interrupt() with no host authentication; an adjacent HDMI device or malicious USB ACM gadget needs no account or capability on the Linux host.
UI:N - Once the Extron is bound via serport, incoming serial lines are parsed automatically in the interrupt handler; an already-connected HDMI source can trigger the overflow without a victim opening a file or clicking.
S:U - The overflow corrupts only the host kernel that runs this CEC USB driver and does not cross a VM, IOMMU, or other separate security authority.
C:H - Attacker-chosen hex bytes are written past the 16-byte on-stack msg.msg[] array (a 256-byte line yields up to ~82 decoded bytes), corrupting kernel stack contents and enabling disclosure of adjacent kernel memory.
I:H - The same out-of-bounds stores smash the kernel stack frame, including saved control data and the return address, enabling control-flow hijacking and arbitrary kernel writes.
A:H - Overflowing the on-stack cec_msg produces a kernel oops or panic from stack-canary abort or corrupted control data, so the host can be crashed at will.
| Attack Vector |
Adjacent Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:A - extron_process_received() hex-decodes Ceci/Ceco lines the Extron DA HD 4K Plus reports from its HDMI ports over USB-serial; a malicious HDMI-CEC source on the same splitter bus (conference-room laptop, signage player) can supply those frames, with a USB gadget impersonating the Extron only an extra physical path.
AC:L - A crafted Ceci/Ceco line of more than 16 %XX triplets deterministically writes past msg.msg[16]; the attacker fully controls the HDMI-CEC or USB-serial payload, and no race or attacker-uncontrollable memory layout is required.
PR:N - HDMI-CEC and the Extron USB-serial reports are parsed in extron_interrupt() with no host authentication; an adjacent HDMI device or malicious USB ACM gadget needs no account or capability on the Linux host.
UI:N - Once the Extron is bound via serport, incoming serial lines are parsed automatically in the interrupt handler; an already-connected HDMI source can trigger the overflow without a victim opening a file or clicking.
S:U - The overflow corrupts only the host kernel that runs this CEC USB driver and does not cross a VM, IOMMU, or other separate security authority.
C:H - Attacker-chosen hex bytes are written past the 16-byte on-stack msg.msg[] array (a 256-byte line yields up to ~82 decoded bytes), corrupting kernel stack contents and enabling disclosure of adjacent kernel memory.
I:H - The same out-of-bounds stores smash the kernel stack frame, including saved control data and the return address, enabling control-flow hijacking and arbitrary kernel writes.
A:H - Overflowing the on-stack cec_msg produces a kernel oops or panic from stack-canary abort or corrupted control data, so the host can be crashed at will.
CVSS 3.1