Critical Memory Access Vulnerability in Linux Kernel Affecting UVC Video Devices
Summary
CVE-2024-58079: In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. Affects linux versions < 6.1.133-1. Fixed in 6.1.133-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It supports a wide range of devices, including UVC (USB Video Class) devices, which are commonly used for webcams and other video input devices. The kernel's robust architecture allows for efficient resource management, but vulnerabilities can arise, particularly in device driver interactions. This specific vulnerability affects the UVC video driver when handling GPIO units, leading to potential system crashes.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the UVC video driver where improper device management can lead to a crash during the unbinding process. The issue arises from using the wrong device for cleanup functions, specifically using the USB device instead of the interface device. When the driver is unbound, cleanup functions are not executed, resulting in IRQs (interrupt requests) attempting to access already freed memory sections, causing an OOPS error. This vulnerability primarily affects devices with GPIO units and requires the user to unbind the device to trigger the issue, making it less impactful during normal operations.
How To Fix
Minimum fixed version
6.1.133-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid unbinding the UVC video driver from devices with GPIO units. Instead, keep the device connected to prevent triggering the vulnerability.
Conclusion
The CVE-2024-58079 vulnerability in the Linux kernel's UVC video driver poses a risk of system crashes due to improper device management. Users are encouraged to update their kernel to the latest version to mitigate this risk and to avoid unbinding the driver from affected devices as a temporary measure. Regular monitoring of vulnerabilities is essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2024-58079 is a vulnerability in the Linux kernel's UVC video driver that can cause system crashes due to improper device management during the unbinding process.
The vulnerability can lead to system crashes if the UVC video driver is unbound from devices with GPIO units, potentially causing data loss or system instability.
Devices using the UVC video driver with GPIO units are affected. You can check if your application is impacted by using the Vulert playground at Vulert Scanner.
If an immediate update is not possible, avoid unbinding the UVC video driver from any devices with GPIO units to mitigate the risk of triggering the vulnerability.
More information can be found in the CVE database or by visiting the official Linux kernel documentation regarding the UVC video driver.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
