CVE-2024-58002

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50
https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb	Patch
https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b
https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac	Patch
https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971	Patch
https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c
https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c	Patch
https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

13 Mar 2025, 13:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50 - () https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b - () https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c -

07 Mar 2025, 18:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927 -

06 Mar 2025, 12:42

Type	Values Removed	Values Added
CPE		cpe:2.3:o:linux:linux_kernel::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8
CWE		CWE-416
First Time		Linux linux Kernel Linux
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: uvcvideo: Eliminar punteros colgantes Cuando se escribe un control asíncrono, copiamos un puntero al identificador de archivo que inició la operación. Ese puntero se utilizará cuando el dispositivo termine. Lo que podría ser en cualquier momento en el futuro. Si el usuario cierra ese descriptor de archivo, se liberará su estructura y habrá un puntero colgante por cada control asíncrono pendiente, que el controlador intentará utilizar. Limpie todos los punteros colgantes durante release(). Para evitar agregar una penalización de rendimiento en el caso más común (sin operación asíncrona), se ha introducido un contador con cierta lógica para asegurarse de que se gestiona correctamente.
References	~~() https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb -~~	() https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb - Patch
References	~~() https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac -~~	() https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac - Patch
References	~~() https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971 -~~	() https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971 - Patch
References	~~() https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c -~~	() https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c - Patch

27 Feb 2025, 13:15

Type	Values Removed	Values Added
References		() https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971 -

27 Feb 2025, 03:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-27 03:15

Updated : 2025-03-13 13:15

NVD link : CVE-2024-58002

Mitre link : CVE-2024-58002

CVE.ORG link : CVE-2024-58002

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-416

Use After Free

{"id": "CVE-2024-58002", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2025-02-27T03:15:11.180", "references": [{"url": "https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: uvcvideo: Eliminar punteros colgantes Cuando se escribe un control as\u00edncrono, copiamos un puntero al identificador de archivo que inici\u00f3 la operaci\u00f3n. Ese puntero se utilizar\u00e1 cuando el dispositivo termine. Lo que podr\u00eda ser en cualquier momento en el futuro. Si el usuario cierra ese descriptor de archivo, se liberar\u00e1 su estructura y habr\u00e1 un puntero colgante por cada control as\u00edncrono pendiente, que el controlador intentar\u00e1 utilizar. Limpie todos los punteros colgantes durante release(). Para evitar agregar una penalizaci\u00f3n de rendimiento en el caso m\u00e1s com\u00fan (sin operaci\u00f3n as\u00edncrona), se ha introducido un contador con cierta l\u00f3gica para asegurarse de que se gestiona correctamente."}], "lastModified": "2025-03-13T13:15:43.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75080FCA-11DD-4E2C-BD8B-593BA4A9E12D", "versionEndExcluding": "6.6.80", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "033BB7EE-C9A2-45EA-BAC9-87BB9D951BCD", "versionEndExcluding": "6.12.14", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00", "versionEndExcluding": "6.13.3", "versionStartIncluding": "6.13"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}

7.8 /10