Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-53104— media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Quick assessment

Affected
Linux Linux
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于media: uvcvideo组件中UVC_VS_UNDEFINED类型帧的解析被跳过，在uvc_parse_streaming计算帧缓冲区大小时未考虑此类型，导致越界写入。

AI Predicted 7.8 Difficulty: Easy KEV EPSS 3.40% · P89

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux c0efd232929c2cd87238de2cccdaf4e845be5b0c< 95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8 affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< 684022f81f128338fe3587ec967459669a1204ae affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< faff5bbb2762c44ec7426037b3000e77a11d6773 affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< 467d84dc78c9abf6b217ada22b3fdba336262e29 affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< beced2cb09b58c1243733f374c560a55382003d6 affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< 575a562f7a3ec2d54ff77ab6810e3fbceef2a91d affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< 622ad10aae5f5e03b7927ea95f7f32812f692bb5 affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c< 1ee9d9122801eb688783acd07791f2906b87cb4f affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-53104

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于media: uvcvideo组件中UVC_VS_UNDEFINED类型帧的解析被跳过，在uvc_parse_streaming计算帧缓冲区大小时未考虑此类型，导致越界写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c0efd232929c2cd87238de2cccdaf4e845be5b0c ~ 95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8 -
Linux Linux 2.6.26 -

II. Public POCs for CVE-2024-53104

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-53104

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-53104 (9)

Same Patch Batch · Linux · 2024-12-02 · 22 CVEs total

CVE-2024-53103 7.8 HIGH hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
CVE-2024-53121 7.8 HIGH net/mlx5: fs, lock FTE when checking if active
CVE-2024-53107 7.8 HIGH fs/proc/task_mmu: prevent integer overflow in pagemap_scan_get_args()
CVE-2024-53109 7.8 HIGH nommu: pass NULL argument to vma_iter_prealloc()
CVE-2024-53122 7.5 HIGH mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
CVE-2024-53120 7.5 HIGH net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
CVE-2024-53124 7.5 HIGH net: fix data-races around sk->sk_forward_alloc
CVE-2024-53106 7.3 HIGH ima: fix buffer overrun in ima_eventdigest_init_common
CVE-2024-53108 7.3 HIGH drm/amd/display: Adjust VSDB parser for replay feature
CVE-2024-53110 7.3 HIGH vp_vdpa: fix id_table array not null terminated error
CVE-2024-53111 7.1 HIGH mm/mremap: fix address wraparound in move_page_tables()
CVE-2024-53114 x86/CPU/AMD: Clear virtualized VMLOAD/VMSAVE on Zen4 client
CVE-2024-53105 mm: page_alloc: move mlocked flag clearance into free_pages_prepare()
CVE-2024-53112 ocfs2: uncache inode which has failed entering the group
CVE-2024-53113 mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
CVE-2024-53115 drm/vmwgfx: avoid null_ptr_deref in vmw_framebuffer_surface_create_handle
CVE-2024-53116 drm/panthor: Fix handling of partial GPU mapping of BOs
CVE-2024-53117 virtio/vsock: Improve MSG_ZEROCOPY error handling
CVE-2024-53119 virtio/vsock: Fix accept_queue memory leak
CVE-2024-53118 vsock: Fix sk_error_queue memory leak

Showing top 20 of 22 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2024-53104

No comments yet

Leave a comment