Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-38621— media: stk1160: fix bounds checking in stk1160_copy_video()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于media:stk1160模块stk1160_copy_video中的边界检查。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.28% · P19

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9cb2173e6ea8f2948bd1367c93083a2500fcf08f< f6a392266276730bea893b55d12940e32a25f56a affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< ecf4ddc3aee8ade504c4d36b7b4053ce6093e200 affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< a16775828aaed1c54ff4e6fe83e8e4d5c6a50cb7 affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< 7532bcec0797adfa08791301c3bcae14141db3bd affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< b504518a397059e1d55c521ba0ea2b545a6c4b52 affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< d410017a7181cb55e4a5c810b32b75e4416c6808 affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< a08492832cc4cacc24e0612f483c86ca899b9261 affected
9cb2173e6ea8f2948bd1367c93083a2500fcf08f< faa4364bef2ec0060de381ff028d1d836600a381 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-38621

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: stk1160: fix bounds checking in stk1160_copy_video()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: stk1160: fix bounds checking in stk1160_copy_video() The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have copied thus far. When the condition is reversed that means the result of the subtraction is always negative but since it's unsigned then the result is a very high positive value. That means the overflow check is never true. Additionally, the ->bytesused doesn't actually work for this purpose because we're not writing to "buf->mem + buf->bytesused". Instead, the math to calculate the destination where we are writing is a bit involved. You calculate the number of full lines already written, multiply by two, skip a line if necessary so that we start on an odd numbered line, and add the offset into the line. To fix this buffer overflow, just take the actual destination where we are writing, if the offset is already out of bounds print an error and return. Otherwise, write up to buf->length bytes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于media:stk1160模块stk1160_copy_video中的边界检查。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9cb2173e6ea8f2948bd1367c93083a2500fcf08f ~ f6a392266276730bea893b55d12940e32a25f56a -
Linux Linux 3.7 -

II. Public POCs for CVE-2024-38621

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-38621

请登录查看更多情报信息。

Mailing List Discussions for CVE-2024-38621 (1)

Other References for CVE-2024-38621 (7)

Same Patch Batch · Linux · 2024-06-21 · 40 CVEs total

CVE-2024-36288 9.8 CRITICAL SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
CVE-2024-38381 8.8 HIGH nfc: nci: Fix uninit-value in nci_rx_work
CVE-2024-33619 7.8 HIGH efi: libstub: only free priv.runtime_map when allocated
CVE-2024-36477 7.8 HIGH tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
CVE-2024-38628 7.8 HIGH usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
CVE-2024-36286 7.8 HIGH netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
CVE-2024-38626 7.8 HIGH fuse: clear FR_SENT when re-adding requests into pending list
CVE-2024-38388 7.8 HIGH ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
CVE-2024-38623 7.8 HIGH fs/ntfs3: Use variable length array instead of fixed size
CVE-2024-38635 7.8 HIGH soundwire: cadence: fix invalid PDI offset
CVE-2024-38659 7.3 HIGH enic: Validate length of nl attributes in enic_set_vf_port
CVE-2024-38631 iio: adc: PAC1934: fix accessing out of bounds array index
CVE-2024-38625 fs/ntfs3: Check 'folio' pointer for NULL
CVE-2024-38632 vfio/pci: fix potential memory leak in vfio_intx_enable()
CVE-2024-38633 serial: max3100: Update uart_driver_registered on driver removal
CVE-2024-38634 serial: max3100: Lock port->lock when calling uart_handle_cts_change()
CVE-2024-38636 f2fs: multidev: fix to recognize valid zero block address
CVE-2024-38637 greybus: lights: check return of get_channel_from_mode
CVE-2024-38662 bpf: Allow delete from sockmap/sockhash only if update is allowed
CVE-2024-38780 dma-buf/sw-sync: don't enable IRQ from sync_print_obj()

Showing top 20 of 40 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-38621

No comments yet

Leave a comment