Linux kernel: out of bounds write in Linux kernel (CVE-2024-53104) #shorts

Summary

Welcome to our cybersecurity podcast. Today, we're diving into CVE-2024-53104, a recently addressed vulnerability in the Linux kernel. This particular issue has been the focus of various security advisories and updates, highlighting its significance across the tech landscape.

Product details

CVE-2024-53104 affects several versions of the Linux kernel, particularly those dealing with uvcvideo. Multiple patches have been released to mitigate the vulnerability, impacting Linux distributions and their respective environments. Major providers, including SUSE, have all issued updates to secure systems against potential exploits.

Vulnerability type summary

The vulnerability is related to the improper parsing of frame types in the Linux kernel's uvcvideo component. It can lead to out-of-bounds writes, a common issue in software security that may allow attackers unauthorized access or control over the affected systems.

Details of the vulnerability

The core of the issue lies in the media:uvcvideo module of the Linux kernel, where frames of the type UVC_VS_UNDEFINED were previously not considered during buffer size calculations in uvc_parse_streaming. This oversight resulted in out-of-bounds writes, presenting an opportunity for exploitation. Thankfully, the vulnerability has been patched, with updates already being pushed out by various Linux distribution maintainers.

Conclusion

In conclusion, CVE-2024-53104 underscores the criticality of maintaining updated systems. It has been actively exploited, prompting quick action from security entities and software vendors alike. Users and administrators are urged to apply the available patches to safeguard their systems against this vulnerability. Stay informed, stay secure.

Watch the full video on YouTube: CVE-2024-53104

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2024-53104

Description

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Provider

Linux

CWE / problem types

Affected Software Versions

Linux:Linux:[{'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '684022f81f128338fe3587ec967459669a1204ae', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': 'faff5bbb2762c44ec7426037b3000e77a11d6773', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '467d84dc78c9abf6b217ada22b3fdba336262e29', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': 'beced2cb09b58c1243733f374c560a55382003d6', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '575a562f7a3ec2d54ff77ab6810e3fbceef2a91d', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '622ad10aae5f5e03b7927ea95f7f32812f692bb5', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': '1ee9d9122801eb688783acd07791f2906b87cb4f', 'status': 'affected', 'versionType': 'git'}, {'version': 'c0efd232929c2cd87238de2cccdaf4e845be5b0c', 'lessThan': 'ecf2b43018da9579842c774b7f35dbe11b5c38dd', 'status': 'affected', 'versionType': 'git'}],Linux:Linux:[{'version': '2.6.26', 'status': 'affected'}, {'version': '0', 'lessThan': '2.6.26', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '4.19.324', 'lessThanOrEqual': '4.19.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.4.286', 'lessThanOrEqual': '5.4.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.10.230', 'lessThanOrEqual': '5.10.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '5.15.172', 'lessThanOrEqual': '5.15.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.1.117', 'lessThanOrEqual': '6.1.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.6.61', 'lessThanOrEqual': '6.6.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.11.8', 'lessThanOrEqual': '6.11.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.12.1', 'lessThanOrEqual': '6.12.*', 'status': 'unaffected', 'versionType': 'semver'}, {'version': '6.13', 'lessThanOrEqual': '*', 'status': 'unaffected', 'versionType': 'original_commit_for_fix'}]

Date Published

2024-12-02T07:29:27.261Z

Last Updated

2025-05-04T09:53:07.798Z