{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58002", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:04:28.915Z", "datePublished": "2025-02-27T02:12:00.223Z", "dateUpdated": "2026-08-05T11:47:20.198Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:20.198Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached entirely through local syscalls on the video character device — VIDIOC_S_EXT_CTRLS followed by close() on /dev/videoN. No physical access or device insertion is needed since the camera is already attached and its normal async-control interrupt drives the use of the stale pointer.\nAC:L - The attacker controls both halves: they choose when to set the asynchronous control and when to close the fd, and can spray the generic kmalloc slab to reclaim the freed uvc_fh before the status event fires. The use can even be forced synchronously in the same close() via uvc_status_put()->uvc_status_stop()->cancel_work_sync(), and the whole sequence is freely repeatable.\nPR:L - Only read/write access to /dev/videoN is required — no capability check exists anywhere on the uvc_ctrl_set/commit path. That access is granted to the ordinary logged-in user via logind ACLs or the video group, and to unprivileged camera services on Android/ChromeOS.\nUI:N - The attacker performs every step themselves — open, set async control, close — with no victim action required. The control-change interrupt that consumes the dangling pointer is autonomous device behaviour.\nS:U - The freed object and the code that uses it are both kernel-resident in the uvcvideo driver; no VM, IOMMU, or sandbox boundary is crossed. This is a standard same-authority kernel memory-safety defect.\nC:H - A pointer to a freed uvc_fh persists in device-scoped uvc_control state and is reclaimable at will from unprivileged userspace, so the driver operates on an attacker- or victim-controlled aliased slab object treated as a struct v4l2_fh. Consistent with use-after-free scoring, this yields high confidentiality impact through control over freed-object contents and leakage of another handle's control-event stream.\nI:H - The stale pointer is the identity token gating event routing, so reclaiming the slot lets an attacker corrupt which file handles receive control-change notifications and type-confuse the reallocated object. Use-after-free conditions of this kind are scored as enabling heap-spray-based write primitives and control-flow corruption.\nA:H - One dangling pointer is left per pending async control in long-lived per-device structures, and the driver subsequently consumes it — a use-after-free that can crash or destabilize the kernel, and which the attacker can re-arm indefinitely by looping open/set/close." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h" ], "versions": [ { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "2a29413ace64627e178fd422dd8a5d95219a2c0b", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "653993f46861f2971e95e9a0e36a34b49dec542c", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "ac18d781466252cd35a3e311e0a4b264260fd927", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "4dbaa738c583a0e947803c69e8996e88cf98d971", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "438bda062b2c40ddd7df23b932e29ffe0a448cac", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "9edc7d25f7e49c33a1ce7a5ffadea2222065516c", "status": "affected", "versionType": "git" }, { "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "221cd51efe4565501a3dbf04cc011b537dcce7fb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h" ], "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.130", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.80", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.291" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.235" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b" }, { "url": "https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c" }, { "url": "https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50" }, { "url": "https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927" }, { "url": "https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971" }, { "url": "https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac" }, { "url": "https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c" }, { "url": "https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb" } ], "title": "media: uvcvideo: Remove dangling pointers", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:33:15.914Z" } } ] } }