cec MsgBuffer Overflow

Vulnerability analysis

The Extron DA HD 4K Plus CEC USB driver processes data received from the USB device without checking that the incoming data length fits within a fixed-size message buffer. A loop writes received data into this buffer, and if the data is longer than expected, it overflows the buffer on the kernel stack. The fix adds a bounds check that rejects incoming data whose length would exceed the buffer capacity before the processing loop begins. The vulnerable code path is reached when the kernel driver receives data from a connected USB device, so an attacker needs physical access to plug in a malicious device that presents itself as an Extron DA HD 4K Plus HDMI splitter; no special privileges are required because the driver loads automatically.