cyfenced.com →

[ CVE-2024-53104 · Published 2 Dec 2024 ]

Linux Kernel Out-of-Bounds Write Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 3%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-02-05

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

CISA: Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 26 Feb 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References