CVE-2025-38679

Root

Cause

The vulnerability resides in the event_seq_changed() handler of the Qualcomm Venus media driver. The handler processes a variable number of properties received from the firmware; the number of properties is provided by the firmware and used to iterate over the payload. However, the payload size is not validated against the actual message length, allowing an out-of-bounds read if the firmware specifies a property count that exceeds the available data [1].

Exploitation

Exploitation requires the ability to deliver a malformed or malicious firmware message to the Venus hardware block. This could be achieved through a compromise of the firmware itself or via local access to the video decoder interface (e.g., through normal media API calls). No elevated privileges beyond access to the media subsystem are needed [2][3][4].

Impact

A successful exploit can cause the kernel to read memory beyond the intended buffer, leading to a system crash (denial of service) or potential disclosure of sensitive information. The issue is rated High with a CVSS v3 score of 7.1 [1].

Mitigation

Patches have been applied to the Linux kernel stable branches (references [2-4]) and are included in the latest firmware update for affected Siemens SIMATIC CN 4100 devices (version V5.0) [1]. Users should update their kernel or apply the specific commit to mitigate the vulnerability.