In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Remove dangling pointers
When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done. Which could be anytime in the future.
If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use.
Clean all the dangling pointers during release().
To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.
[
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"293377962481849364283007788804972300822",
"264253069764770266319851601098552541511",
"276182371393100985519147697452496620967",
"123595611439483164900497717865098713449",
"246084999951079354067557631733983243858",
"138037360416050449181766003269149606767",
"66935870155663559247412898097807685051",
"132348130686983297084309234864294901327",
"329908441336669557572958485081415014384",
"193555987280763240449954504097162204649",
"94248726462871110303286624973939960866"
]
},
"id": "CVE-2024-58002-00f4ed22",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"329284393973593706205918375310505685819",
"108456284848356907390622814415280681374",
"87030314142455177551805449932211027089"
]
},
"id": "CVE-2024-58002-018a3c79",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"293377962481849364283007788804972300822",
"264253069764770266319851601098552541511",
"276182371393100985519147697452496620967",
"123595611439483164900497717865098713449",
"246084999951079354067557631733983243858",
"138037360416050449181766003269149606767",
"66935870155663559247412898097807685051",
"132348130686983297084309234864294901327",
"329908441336669557572958485081415014384",
"193555987280763240449954504097162204649",
"94248726462871110303286624973939960866"
]
},
"id": "CVE-2024-58002-195b373a",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_commit_entity"
},
"digest": {
"length": 960.0,
"function_hash": "306083577686353406642494236730683676353"
},
"id": "CVE-2024-58002-25700b16",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"231671339736260792006448989478646983054",
"89995117851564092934084803820072057153",
"137539981905255888695523320045833016452",
"110350914703460349061255068285210796434",
"307672309965225769416973693678903621893",
"53355767981088845292062398111606626653",
"36301203596488082874982025786002987028",
"73684319519290088596805730848782713829",
"182205960323409975751185846148921439699",
"335687526305936952705962919892435450779",
"56494243724282265510971088879478306394",
"142232393278349907229029587664189793640",
"27515285704882537130936655578898493908",
"48460567285668084934756717127943724888"
]
},
"id": "CVE-2024-58002-31f8e326",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"293377962481849364283007788804972300822",
"264253069764770266319851601098552541511",
"276182371393100985519147697452496620967",
"123595611439483164900497717865098713449",
"246084999951079354067557631733983243858",
"138037360416050449181766003269149606767",
"66935870155663559247412898097807685051",
"132348130686983297084309234864294901327",
"289024091962392885559581785453990333413",
"143878988382374393034410725016065034678",
"180797030396264670568647853658114485441"
]
},
"id": "CVE-2024-58002-33241ff4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c",
"function": "uvc_v4l2_release"
},
"digest": {
"length": 519.0,
"function_hash": "9006504356238613592236334836857395110"
},
"id": "CVE-2024-58002-37991248",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c",
"function": "uvc_v4l2_release"
},
"digest": {
"length": 519.0,
"function_hash": "9006504356238613592236334836857395110"
},
"id": "CVE-2024-58002-39c533a3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"329284393973593706205918375310505685819",
"108456284848356907390622814415280681374",
"87030314142455177551805449932211027089"
]
},
"id": "CVE-2024-58002-3dd00c51",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"293377962481849364283007788804972300822",
"264253069764770266319851601098552541511",
"276182371393100985519147697452496620967",
"158407960494165553257930129878763164110",
"246084999951079354067557631733983243858",
"138037360416050449181766003269149606767",
"66935870155663559247412898097807685051",
"132348130686983297084309234864294901327",
"276013186600375459963623114651518656775",
"143878988382374393034410725016065034678",
"180797030396264670568647853658114485441"
]
},
"id": "CVE-2024-58002-4340f863",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"231671339736260792006448989478646983054",
"89995117851564092934084803820072057153",
"137539981905255888695523320045833016452",
"110350914703460349061255068285210796434",
"307672309965225769416973693678903621893",
"53355767981088845292062398111606626653",
"36301203596488082874982025786002987028",
"73684319519290088596805730848782713829",
"182205960323409975751185846148921439699",
"335687526305936952705962919892435450779",
"56494243724282265510971088879478306394",
"142232393278349907229029587664189793640",
"27515285704882537130936655578898493908",
"48460567285668084934756717127943724888"
]
},
"id": "CVE-2024-58002-5191affb",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_commit_entity"
},
"digest": {
"length": 1011.0,
"function_hash": "227451783495523343679485225903209559170"
},
"id": "CVE-2024-58002-520724ff",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_status_event"
},
"digest": {
"length": 592.0,
"function_hash": "279887710174333264008397912228633390731"
},
"id": "CVE-2024-58002-63f4c8be",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"48657508260178406944067232648267852432",
"86424244952945935633741359112578026963",
"33097213304998769489575962177252157916"
]
},
"id": "CVE-2024-58002-677a821b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c",
"function": "uvc_v4l2_release"
},
"digest": {
"length": 519.0,
"function_hash": "9006504356238613592236334836857395110"
},
"id": "CVE-2024-58002-69433873",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_commit_entity"
},
"digest": {
"length": 1011.0,
"function_hash": "227451783495523343679485225903209559170"
},
"id": "CVE-2024-58002-6ff9c554",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_commit_entity"
},
"digest": {
"length": 1011.0,
"function_hash": "227451783495523343679485225903209559170"
},
"id": "CVE-2024-58002-700dc951",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"293377962481849364283007788804972300822",
"264253069764770266319851601098552541511",
"276182371393100985519147697452496620967",
"123595611439483164900497717865098713449",
"246084999951079354067557631733983243858",
"138037360416050449181766003269149606767",
"66935870155663559247412898097807685051",
"132348130686983297084309234864294901327",
"329908441336669557572958485081415014384",
"193555987280763240449954504097162204649",
"94248726462871110303286624973939960866"
]
},
"id": "CVE-2024-58002-79de70fc",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"231671339736260792006448989478646983054",
"89995117851564092934084803820072057153",
"137539981905255888695523320045833016452",
"110350914703460349061255068285210796434",
"307672309965225769416973693678903621893",
"53355767981088845292062398111606626653",
"36301203596488082874982025786002987028",
"73684319519290088596805730848782713829",
"182205960323409975751185846148921439699",
"335687526305936952705962919892435450779",
"56494243724282265510971088879478306394",
"142232393278349907229029587664189793640",
"27515285704882537130936655578898493908",
"48460567285668084934756717127943724888"
]
},
"id": "CVE-2024-58002-9e9c4655",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_status_event"
},
"digest": {
"length": 592.0,
"function_hash": "279887710174333264008397912228633390731"
},
"id": "CVE-2024-58002-aa87ac2f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_commit_entity"
},
"digest": {
"length": 1011.0,
"function_hash": "227451783495523343679485225903209559170"
},
"id": "CVE-2024-58002-b1409346",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@438bda062b2c40ddd7df23b932e29ffe0a448cac",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"231671339736260792006448989478646983054",
"89995117851564092934084803820072057153",
"137539981905255888695523320045833016452",
"110350914703460349061255068285210796434",
"307672309965225769416973693678903621893",
"53355767981088845292062398111606626653",
"36301203596488082874982025786002987028",
"73684319519290088596805730848782713829",
"182205960323409975751185846148921439699",
"335687526305936952705962919892435450779",
"56494243724282265510971088879478306394",
"142232393278349907229029587664189793640",
"27515285704882537130936655578898493908",
"48460567285668084934756717127943724888"
]
},
"id": "CVE-2024-58002-b89f105b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_status_event"
},
"digest": {
"length": 592.0,
"function_hash": "279887710174333264008397912228633390731"
},
"id": "CVE-2024-58002-bb59f8f3",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_status_event"
},
"digest": {
"length": 592.0,
"function_hash": "279887710174333264008397912228633390731"
},
"id": "CVE-2024-58002-c56f8024",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"231671339736260792006448989478646983054",
"89995117851564092934084803820072057153",
"137539981905255888695523320045833016452",
"110350914703460349061255068285210796434",
"307672309965225769416973693678903621893",
"53355767981088845292062398111606626653",
"36301203596488082874982025786002987028",
"273264729549480984997146241741991526671",
"182205960323409975751185846148921439699",
"335687526305936952705962919892435450779",
"56494243724282265510971088879478306394",
"142232393278349907229029587664189793640",
"27515285704882537130936655578898493908",
"48460567285668084934756717127943724888"
]
},
"id": "CVE-2024-58002-c60421c8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c",
"function": "uvc_v4l2_release"
},
"digest": {
"length": 519.0,
"function_hash": "252046002826204394788617568956433243326"
},
"id": "CVE-2024-58002-cb79b1b4",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@653993f46861f2971e95e9a0e36a34b49dec542c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"329284393973593706205918375310505685819",
"108456284848356907390622814415280681374",
"87030314142455177551805449932211027089"
]
},
"id": "CVE-2024-58002-cc26242d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_ctrl.c",
"function": "uvc_ctrl_status_event"
},
"digest": {
"length": 592.0,
"function_hash": "279887710174333264008397912228633390731"
},
"id": "CVE-2024-58002-ddeaca54",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ac18d781466252cd35a3e311e0a4b264260fd927",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c",
"function": "uvc_v4l2_release"
},
"digest": {
"length": 412.0,
"function_hash": "27489006325152395265909191129313726425"
},
"id": "CVE-2024-58002-e253a739",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/media/usb/uvc/uvc_v4l2.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"329284393973593706205918375310505685819",
"108456284848356907390622814415280681374",
"87030314142455177551805449932211027089"
]
},
"id": "CVE-2024-58002-fbe50d9b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9edc7d25f7e49c33a1ce7a5ffadea2222065516c",
"signature_version": "v1"
}
]