CVE-2024-58002
Published: 27 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.
Security Summary
CVE-2024-58002 is a use-after-free vulnerability (CWE-416) in the Linux kernel's uvcvideo driver, which handles USB Video Class devices such as webcams. The issue arises during asynchronous control operations, where the driver copies a pointer to the file handle that initiated the operation. If the user closes the file descriptor before the operation completes, the structure is freed, leaving dangling pointers—one per pending async control—that the driver later attempts to use.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes on affected systems with USB video devices in use.
The vulnerability has been addressed in multiple stable kernel commits, including 117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50, 221cd51efe4565501a3dbf04cc011b537dcce7fb, 2a29413ace64627e178fd422dd8a5d95219a2c0b, 438bda062b2c40ddd7df23b932e29ffe0a448cac, and 4dbaa738c583a0e947803c69e8996e88cf98d971. These patches clean up dangling pointers during file release() and introduce a counter to avoid performance penalties in common cases without async operations. Security practitioners should apply these updates to mitigate the risk.
Details
- CWE(s)