CVE-2024-53061 (GCVE-0-2024-53061)
Vulnerability from cvelistv5
Published
2024-11-19 17:22
Modified
2026-08-05 11:43
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
Version: 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-53061",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-13T01:39:25.933440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-191",
                "description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T17:53:49.672Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:28:56.360Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c5f6fefcda8fac8f082b6c5bf416567f4e100c51",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "a930cddfd153b5d4401df0c01effa14c831ff21e",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "c85db2d4432de4ff9d97006691ce2dcb5bda660e",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "784bc785a453eb2f8433dd62075befdfa1b2d6fd",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "c951a0859fdacf49a2298b5551a7e52b95ff6f51",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            },
            {
              "lessThan": "14a22762c3daeac59a5a534e124acbb4d7a79b3a",
              "status": "affected",
              "version": "6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.324",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.286",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.172",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.324",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.286",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: s5p-jpeg: prevent buffer overflows\n\nThe current logic allows word to be less than 2. If this happens,\nthere will be buffer overflows, as reported by smatch. Add extra\nchecks to prevent it.\n\nWhile here, remove an unused word = 0 assignment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires opening the s5p-jpeg V4L2 M2M device node (/dev/videoN) and issuing a local S_FMT/REQBUFS/QBUF/STREAMON ioctl sequence with a crafted JPEG in the OUTPUT buffer. There is no network-facing path to the parser.\nAC:L - The attacker fully controls every byte of the JPEG header; setting a DHT/DQT/SOF0 or SOS length field to 0x0000 deterministically produces the integer underflow with no race, timing, or memory-layout precondition. Reaching device_run only requires an otherwise well-formed header with a valid SOF/SOS and subsampling value.\nPR:L - An unprivileged local account with access to /dev/video* is sufficient \u2014 udev/logind grant seat users this ACL on desktop and embedded Linux, and on Android Exynos devices the camera/media UID reaches it. No CAP_SYS_ADMIN or root is needed.\nUI:N - The attacker performs the entire QBUF/STREAMON sequence itself against a device node it opened; no victim action, file open, or mount is involved.\nS:U - The out-of-bounds access and the resulting crash are confined to the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The underflowed size permits an effectively unbounded (up to ~4 GiB) out-of-bounds read past the vb2 dma-contig buffer, far beyond \"a few bytes\". Those kernel bytes are loaded into the JPEG IP\u0027s quantization/Huffman table registers, and since dequantized coefficients are coeff \u00d7 qtbl[k], a crafted entropy-coded stream leaks them back to userspace in the decoded CAPTURE buffer at an attacker-chosen offset.\nI:L - Out-of-bounds data drives writel() to attacker-influenced offsets past the intended Huffman-table register windows, corrupting JPEG IP state and the decoded output returned to userspace. The writes stay within the 64 KB ioremap window and cannot reach the DMA base-address registers, so there is no kernel-memory or arbitrary-write primitive.\nA:H - Sequentially reading gigabytes past a dma-contig allocation will hit unmapped or non-RAM addresses, and the parsers run under spin_lock_irqsave() in exynos4_jpeg_device_run() with interrupts disabled, so the fault becomes an oops/panic in atomic context. The condition is trivially and repeatedly triggerable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:24.079Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c5f6fefcda8fac8f082b6c5bf416567f4e100c51"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/a930cddfd153b5d4401df0c01effa14c831ff21e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c85db2d4432de4ff9d97006691ce2dcb5bda660e"
        },
        {
          "url": "https://git.kernel.org/stable/c/784bc785a453eb2f8433dd62075befdfa1b2d6fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c951a0859fdacf49a2298b5551a7e52b95ff6f51"
        },
        {
          "url": "https://git.kernel.org/stable/c/14a22762c3daeac59a5a534e124acbb4d7a79b3a"
        }
      ],
      "title": "media: s5p-jpeg: prevent buffer overflows",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-53061",
    "datePublished": "2024-11-19T17:22:32.189Z",
    "dateReserved": "2024-11-19T17:17:24.975Z",
    "dateUpdated": "2026-08-05T11:43:24.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:28:56.360Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53061\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-13T01:39:25.933440Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-191\", \"description\": \"CWE-191 Integer Underflow (Wrap or Wraparound)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-18T16:03:49.000Z\"}}], \"cna\": {\"title\": \"media: s5p-jpeg: prevent buffer overflows\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Exploitation requires opening the s5p-jpeg V4L2 M2M device node (/dev/videoN) and issuing a local S_FMT/REQBUFS/QBUF/STREAMON ioctl sequence with a crafted JPEG in the OUTPUT buffer. There is no network-facing path to the parser.\\nAC:L - The attacker fully controls every byte of the JPEG header; setting a DHT/DQT/SOF0 or SOS length field to 0x0000 deterministically produces the integer underflow with no race, timing, or memory-layout precondition. Reaching device_run only requires an otherwise well-formed header with a valid SOF/SOS and subsampling value.\\nPR:L - An unprivileged local account with access to /dev/video* is sufficient \\u2014 udev/logind grant seat users this ACL on desktop and embedded Linux, and on Android Exynos devices the camera/media UID reaches it. No CAP_SYS_ADMIN or root is needed.\\nUI:N - The attacker performs the entire QBUF/STREAMON sequence itself against a device node it opened; no victim action, file open, or mount is involved.\\nS:U - The out-of-bounds access and the resulting crash are confined to the kernel\u0027s own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The underflowed size permits an effectively unbounded (up to ~4 GiB) out-of-bounds read past the vb2 dma-contig buffer, far beyond \\\"a few bytes\\\". Those kernel bytes are loaded into the JPEG IP\u0027s quantization/Huffman table registers, and since dequantized coefficients are coeff \\u00d7 qtbl[k], a crafted entropy-coded stream leaks them back to userspace in the decoded CAPTURE buffer at an attacker-chosen offset.\\nI:L - Out-of-bounds data drives writel() to attacker-influenced offsets past the intended Huffman-table register windows, corrupting JPEG IP state and the decoded output returned to userspace. The writes stay within the 64 KB ioremap window and cannot reach the DMA base-address registers, so there is no kernel-memory or arbitrary-write primitive.\\nA:H - Sequentially reading gigabytes past a dma-contig allocation will hit unmapped or non-RAM addresses, and the parsers run under spin_lock_irqsave() in exynos4_jpeg_device_run() with interrupts disabled, so the fault becomes an oops/panic in atomic context. The condition is trivially and repeatedly triggerable.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"c5f6fefcda8fac8f082b6c5bf416567f4e100c51\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"a930cddfd153b5d4401df0c01effa14c831ff21e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"c85db2d4432de4ff9d97006691ce2dcb5bda660e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"784bc785a453eb2f8433dd62075befdfa1b2d6fd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"c951a0859fdacf49a2298b5551a7e52b95ff6f51\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4\", \"lessThan\": \"14a22762c3daeac59a5a534e124acbb4d7a79b3a\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.324\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.286\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.172\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.117\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.61\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/platform/samsung/s5p-jpeg/jpeg-core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c5f6fefcda8fac8f082b6c5bf416567f4e100c51\"}, {\"url\": \"https://git.kernel.org/stable/c/e5117f6e7adcf9fd7546cdd0edc9abe4474bc98b\"}, {\"url\": \"https://git.kernel.org/stable/c/f54e8e1e39dacccebcfb9a9a36f0552a0a97e2ef\"}, {\"url\": \"https://git.kernel.org/stable/c/a930cddfd153b5d4401df0c01effa14c831ff21e\"}, {\"url\": \"https://git.kernel.org/stable/c/c85db2d4432de4ff9d97006691ce2dcb5bda660e\"}, {\"url\": \"https://git.kernel.org/stable/c/784bc785a453eb2f8433dd62075befdfa1b2d6fd\"}, {\"url\": \"https://git.kernel.org/stable/c/c951a0859fdacf49a2298b5551a7e52b95ff6f51\"}, {\"url\": \"https://git.kernel.org/stable/c/14a22762c3daeac59a5a534e124acbb4d7a79b3a\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: s5p-jpeg: prevent buffer overflows\\n\\nThe current logic allows word to be less than 2. If this happens,\\nthere will be buffer overflows, as reported by smatch. Add extra\\nchecks to prevent it.\\n\\nWhile here, remove an unused word = 0 assignment.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.324\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.286\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.230\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.172\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.117\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.61\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"4.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:43:24.079Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-53061\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:43:24.079Z\", \"dateReserved\": \"2024-11-19T17:17:24.975Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T17:22:32.189Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.