CVEvulnerability

CVE-2024-53104

7.8 HIGH Known exploited Published 2024-12-02 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Linux Kernel Out-of-Bounds Write Vulnerability — Linux Kernel

Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

Added to KEV
2025-02-05
Remediation due
2025-02-26
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024120232-CVE-2024-53104-d781@gregkh/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-53104
Status
Analyzed
Published
2024-12-02
Last modified
2026-06-17
Assigner
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Affected configurations

• debian debian linux 11.0 • linux linux kernel (>= 2.6.26 < 4.19.324) • linux linux kernel (>= 4.20 < 5.4.286) • linux linux kernel (>= 5.5 < 5.10.230) • linux linux kernel (>= 5.11 < 5.15.172) • linux linux kernel (>= 5.16 < 6.1.117) • linux linux kernel (>= 6.2 < 6.6.61) • linux linux kernel (>= 6.7 < 6.11.8) • linux linux kernel (>= 6.12 < 6.12.1)

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References