CVE-2024-58079 (GCVE-0-2024-58079)
Vulnerability from cvelistv5
Published
2025-03-06 16:13
Modified
2026-08-05 11:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device. If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled. If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS. We cannot use the function devm_request_threaded_irq here. The devm_* clean functions may be called after the main structure is released by uvc_delete. Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
Version: 2886477ff98740cc3333cf785e4de0b1ff3d7a28
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:34:12.917Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/uvc/uvc_driver.c",
            "drivers/media/usb/uvc/uvcvideo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fdd7cc593385e46e92e180b71e264fc9c195298",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            },
            {
              "lessThan": "3c00e94d00ca079bef7906d6f39d1091bccfedd3",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            },
            {
              "lessThan": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            },
            {
              "lessThan": "d2eac8b14ac690aa73052aa6d4ba69005715367e",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            },
            {
              "lessThan": "5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            },
            {
              "lessThan": "a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
              "status": "affected",
              "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/uvc/uvc_driver.c",
            "drivers/media/usb/uvc/uvcvideo.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.130",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.78",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.14",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker\u0027s action is entirely local \u2014 unbinding uvcvideo from the USB interface via the usbfs `USBDEVFS_DISCONNECT` ioctl on `/dev/bus/usb/BBB/DDD`, a sysfs `unbind` write, or `rmmod`, followed by local heap grooming. No network or adjacent-network input reaches this code, and no device insertion is needed since the camera is already attached.\nAC:L - The unbind deterministically leaves the IRQ registered against the freed `uvc_device` with no race window \u2014 the dangling registration persists indefinitely until the next privacy-line transition, and the IRQ is armed on both edges (`IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING`). Reclaiming the freed `uvc_device`/`uvc_entity` slabs is ordinary attacker-controlled heap spraying, not a condition outside the attacker\u0027s influence.\nPR:L - `usbdev_do_ioctl()` performs no capability check at all \u2014 `USBDEVFS_DISCONNECT` needs only write access to the usbfs node, which is routinely granted to unprivileged users on systems running libusb/libuvc camera userspace (libusb\u0027s `detach_kernel_driver` is implemented with this exact ioctl) and to containers given `/dev/bus/usb` passthrough. So a basic unprivileged local account, not real root, is sufficient to free the object while the IRQ stays armed.\nUI:N - No victim action is required for the attack itself: the attacker performs the unbind and the heap spray, and the stale IRQ remains armed indefinitely so the next privacy-switch/camera-mute transition \u2014 which the attacker on these laptop/Chromebook form factors can cause directly, and which occurs in normal operation regardless \u2014 fires the freed handler.\nS:U - The use-after-free corrupts kernel heap memory and hijacks control flow within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The handler reads a fully attacker-reclaimable freed `uvc_device` and `uvc_entity`, and `gpiod_get_raw_value_commit()` dereferences the attacker-controlled `gpio_desc *` chain (`desc-\u003egdev` \u2192 `gdev-\u003echip`), giving an arbitrary-read primitive and, via the resulting controlled indirect call, disclosure of arbitrary kernel memory.\nI:H - `gc-\u003eget(gc, offset)` is an indirect call through a function pointer sourced from reclaimed heap contents, and `uvc_ctrl_status_event()` performs `mutex_lock()` and list manipulation on a bogus `chain` from the freed `dev-\u003echains` head \u2014 together an arbitrary-write and code-execution primitive; after `rmmod` the IRQ action even points into unloaded module text.\nA:H - As the commit states, an IRQ after unbind \"will try to access memory sections that are already free, causing an OOPS\" \u2014 a kernel panic/crash on the affected device, and any unexploited attempt reliably crashes the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:35.196Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fdd7cc593385e46e92e180b71e264fc9c195298"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c00e94d00ca079bef7906d6f39d1091bccfedd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b5e0445bc8384c18bd35cb9fe87f6258c6271d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2eac8b14ac690aa73052aa6d4ba69005715367e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5"
        }
      ],
      "title": "media: uvcvideo: Fix crash during unbind if gpio unit is in use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58079",
    "datePublished": "2025-03-06T16:13:42.640Z",
    "dateReserved": "2025-03-06T15:52:09.183Z",
    "dateUpdated": "2026-08-05T11:47:35.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.