{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58079", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-06T15:52:09.183Z", "datePublished": "2025-03-06T16:13:42.640Z", "dateUpdated": "2026-08-05T11:47:35.196Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:35.196Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attacker's action is entirely local — unbinding uvcvideo from the USB interface via the usbfs `USBDEVFS_DISCONNECT` ioctl on `/dev/bus/usb/BBB/DDD`, a sysfs `unbind` write, or `rmmod`, followed by local heap grooming. No network or adjacent-network input reaches this code, and no device insertion is needed since the camera is already attached.\nAC:L - The unbind deterministically leaves the IRQ registered against the freed `uvc_device` with no race window — the dangling registration persists indefinitely until the next privacy-line transition, and the IRQ is armed on both edges (`IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING`). Reclaiming the freed `uvc_device`/`uvc_entity` slabs is ordinary attacker-controlled heap spraying, not a condition outside the attacker's influence.\nPR:L - `usbdev_do_ioctl()` performs no capability check at all — `USBDEVFS_DISCONNECT` needs only write access to the usbfs node, which is routinely granted to unprivileged users on systems running libusb/libuvc camera userspace (libusb's `detach_kernel_driver` is implemented with this exact ioctl) and to containers given `/dev/bus/usb` passthrough. So a basic unprivileged local account, not real root, is sufficient to free the object while the IRQ stays armed.\nUI:N - No victim action is required for the attack itself: the attacker performs the unbind and the heap spray, and the stale IRQ remains armed indefinitely so the next privacy-switch/camera-mute transition — which the attacker on these laptop/Chromebook form factors can cause directly, and which occurs in normal operation regardless — fires the freed handler.\nS:U - The use-after-free corrupts kernel heap memory and hijacks control flow within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The handler reads a fully attacker-reclaimable freed `uvc_device` and `uvc_entity`, and `gpiod_get_raw_value_commit()` dereferences the attacker-controlled `gpio_desc *` chain (`desc->gdev` → `gdev->chip`), giving an arbitrary-read primitive and, via the resulting controlled indirect call, disclosure of arbitrary kernel memory.\nI:H - `gc->get(gc, offset)` is an indirect call through a function pointer sourced from reclaimed heap contents, and `uvc_ctrl_status_event()` performs `mutex_lock()` and list manipulation on a bogus `chain` from the freed `dev->chains` head — together an arbitrary-write and code-execution primitive; after `rmmod` the IRQ action even points into unloaded module text.\nA:H - As the commit states, an IRQ after unbind \"will try to access memory sections that are already free, causing an OOPS\" — a kernel panic/crash on the affected device, and any unexploited attempt reliably crashes the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h" ], "versions": [ { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0fdd7cc593385e46e92e180b71e264fc9c195298", "status": "affected", "versionType": "git" }, { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "3c00e94d00ca079bef7906d6f39d1091bccfedd3", "status": "affected", "versionType": "git" }, { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9", "status": "affected", "versionType": "git" }, { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "d2eac8b14ac690aa73052aa6d4ba69005715367e", "status": "affected", "versionType": "git" }, { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d", "status": "affected", "versionType": "git" }, { "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h" ], "versions": [ { "version": "5.12", "status": "affected" }, { "version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.130", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.78", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.13.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/0fdd7cc593385e46e92e180b71e264fc9c195298" }, { "url": "https://git.kernel.org/stable/c/3c00e94d00ca079bef7906d6f39d1091bccfedd3" }, { "url": "https://git.kernel.org/stable/c/0b5e0445bc8384c18bd35cb9fe87f6258c6271d9" }, { "url": "https://git.kernel.org/stable/c/d2eac8b14ac690aa73052aa6d4ba69005715367e" }, { "url": "https://git.kernel.org/stable/c/5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d" }, { "url": "https://git.kernel.org/stable/c/a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5" } ], "title": "media: uvcvideo: Fix crash during unbind if gpio unit is in use", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:34:12.917Z" } } ] } }