Linux · Kernel
CVE-2024-53104
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
Qué es
In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
This can lead to out of bounds writes since frames of this type were not
taken into account when calculating the size of the frames buffer in
uvc_parse_streaming.
CISA: Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 26 de febrero de 2025
- Añadida a la lista de CISA
- 5 de febrero de 2025
- Publicada
- 2 de diciembre de 2024
- Gravedad
- Alto 7,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 3,4% entre el 11,2% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-787
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (9)
- https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8
- https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204ae
- https://git.kernel.org/stable/c/faff5bbb2762c44ec7426037b3000e77a11d6773
- https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29
- https://git.kernel.org/stable/c/beced2cb09b58c1243733f374c560a55382003d6
- https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91d
- https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5
- https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4f
- https://git.kernel.org/stable/c/ecf2b43018da9579842c774b7f35dbe11b5c38dd
Más fallos explotados de Linux
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 18 sept 2026 | Improper Check for Unusual or Exceptional Conditions | Kernel | Crítica 9,8 | 3,3% |
| 18 sept 2026 | Race Condition | Kernel | Alto 7,8 | 1,6% |
| 18 sept 2026 | Out-of-Bounds Write | Kernel | Alto 8,8 | 0,9% |
| 27 ago 2026 | Unspecified | Kernel | Alto 7,8 | 0,7% |
| 26 ago 2026 | Out-of-Bounds Write | Kernel | Alto 7,8 | 8,9% |
| 2 jun 2026 | Improper Authentication | Kernel | Alto 7,8 | 5,5% |
| 1 may 2026 | Incorrect Resource Transfer Between Spheres | Kernel | Alto 7,8 | 98% |
| 26 ene 2026 | Integer Overflow | Kernel | Alto 7,8 | 15% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.