In the Linux kernel, the following vulnerability has been resolved:
media: uvcvideo: Fix crash during unbind if gpio unit is in use
We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device.
If we unbind the driver from the usb interface, the cleanup functions are never called. In our case, the IRQ is never disabled.
If an IRQ is triggered, it will try to access memory sections that are already free, causing an OOPS.
We cannot use the function devmrequestthreadedirq here. The devm* clean functions may be called after the main structure is released by uvc_delete.
Luckily this bug has small impact, as it is only affected by devices with gpio units and the user has to unbind the device, a disconnect will not trigger this error.
[
{
"id": "CVE-2024-58079-1608b195",
"signature_version": "v1",
"digest": {
"function_hash": "208767298029963882284937531521123964911",
"length": 608.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c00e94d00ca079bef7906d6f39d1091bccfedd3",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_unregister_video"
}
},
{
"id": "CVE-2024-58079-175447d3",
"signature_version": "v1",
"digest": {
"function_hash": "118215303404898927994712255530944195767",
"length": 863.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_parse"
}
},
{
"id": "CVE-2024-58079-207966e8",
"signature_version": "v1",
"digest": {
"function_hash": "112506741816847947299509739087203083343",
"length": 305.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2eac8b14ac690aa73052aa6d4ba69005715367e",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_init_irq"
}
},
{
"id": "CVE-2024-58079-39862abe",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286993007120515829649865086713396177184",
"118132717796359075100426228494644901970",
"274363091707622544385946774946875845624",
"144387105511575598457876558038993250780",
"162837650456278016619040382711550146920",
"6765641804440571231391549163726134091",
"88809560730868689537785665455917566860",
"301413192370373409162843665530761644407",
"8663664540742757081226336159702087543",
"55396036325060141824406712543143836531",
"80892279917008486933638197384647057029",
"90878923158905423537968859365544846986",
"24109282392511675122412015066732555133",
"267987946135103041813562499914543548785",
"46570669055090829139903672947831538697",
"163646641803072751357397526448310125418",
"69432951356938052394415641795502806477",
"200649715582688719422715792637989252008",
"157834423219453983464559793422820129713",
"216092648765066716740110058885071544276",
"284558818902349782864407212919896761238",
"280436051060498590488003276166476411196",
"119972468625763813745854130620452258389",
"172473620327172217443917015324700550573"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
}
},
{
"id": "CVE-2024-58079-3b50e2fe",
"signature_version": "v1",
"digest": {
"function_hash": "208767298029963882284937531521123964911",
"length": 608.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2eac8b14ac690aa73052aa6d4ba69005715367e",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_unregister_video"
}
},
{
"id": "CVE-2024-58079-45e1410c",
"signature_version": "v1",
"digest": {
"function_hash": "47554739387030902404722002089258337137",
"length": 836.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c00e94d00ca079bef7906d6f39d1091bccfedd3",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_parse"
}
},
{
"id": "CVE-2024-58079-504f9538",
"signature_version": "v1",
"digest": {
"function_hash": "47554739387030902404722002089258337137",
"length": 836.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_parse"
}
},
{
"id": "CVE-2024-58079-581f56f0",
"signature_version": "v1",
"digest": {
"function_hash": "208767298029963882284937531521123964911",
"length": 608.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_unregister_video"
}
},
{
"id": "CVE-2024-58079-582aec13",
"signature_version": "v1",
"digest": {
"function_hash": "47554739387030902404722002089258337137",
"length": 836.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2eac8b14ac690aa73052aa6d4ba69005715367e",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_parse"
}
},
{
"id": "CVE-2024-58079-6976513d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174077061543682656406221435861262905763",
"208227941803634309814760177569624361190",
"52902324518338027122648876223828788975",
"328508236822006574458420045533290265407"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c00e94d00ca079bef7906d6f39d1091bccfedd3",
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
}
},
{
"id": "CVE-2024-58079-8c726099",
"signature_version": "v1",
"digest": {
"function_hash": "112506741816847947299509739087203083343",
"length": 305.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_init_irq"
}
},
{
"id": "CVE-2024-58079-936f7e78",
"signature_version": "v1",
"digest": {
"function_hash": "112506741816847947299509739087203083343",
"length": 305.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_init_irq"
}
},
{
"id": "CVE-2024-58079-97ac0ff6",
"signature_version": "v1",
"digest": {
"function_hash": "208767298029963882284937531521123964911",
"length": 608.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_unregister_video"
}
},
{
"id": "CVE-2024-58079-bdf146b7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174077061543682656406221435861262905763",
"208227941803634309814760177569624361190",
"52902324518338027122648876223828788975",
"328508236822006574458420045533290265407"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
}
},
{
"id": "CVE-2024-58079-c76775e6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286993007120515829649865086713396177184",
"118132717796359075100426228494644901970",
"274363091707622544385946774946875845624",
"144387105511575598457876558038993250780",
"162837650456278016619040382711550146920",
"6765641804440571231391549163726134091",
"88809560730868689537785665455917566860",
"301413192370373409162843665530761644407",
"8663664540742757081226336159702087543",
"55396036325060141824406712543143836531",
"80892279917008486933638197384647057029",
"90878923158905423537968859365544846986",
"24109282392511675122412015066732555133",
"267987946135103041813562499914543548785",
"46570669055090829139903672947831538697",
"163646641803072751357397526448310125418",
"69432951356938052394415641795502806477",
"200649715582688719422715792637989252008",
"157834423219453983464559793422820129713",
"216092648765066716740110058885071544276",
"284558818902349782864407212919896761238",
"280436051060498590488003276166476411196",
"119972468625763813745854130620452258389",
"172473620327172217443917015324700550573"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c00e94d00ca079bef7906d6f39d1091bccfedd3",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
}
},
{
"id": "CVE-2024-58079-c8104f9b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174077061543682656406221435861262905763",
"208227941803634309814760177569624361190",
"52902324518338027122648876223828788975",
"328508236822006574458420045533290265407"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b5e0445bc8384c18bd35cb9fe87f6258c6271d9",
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
}
},
{
"id": "CVE-2024-58079-c8d94323",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"174077061543682656406221435861262905763",
"208227941803634309814760177569624361190",
"52902324518338027122648876223828788975",
"328508236822006574458420045533290265407"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2eac8b14ac690aa73052aa6d4ba69005715367e",
"target": {
"file": "drivers/media/usb/uvc/uvcvideo.h"
}
},
{
"id": "CVE-2024-58079-db252390",
"signature_version": "v1",
"digest": {
"function_hash": "112506741816847947299509739087203083343",
"length": 305.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3c00e94d00ca079bef7906d6f39d1091bccfedd3",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c",
"function": "uvc_gpio_init_irq"
}
},
{
"id": "CVE-2024-58079-de1c85b6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286993007120515829649865086713396177184",
"118132717796359075100426228494644901970",
"274363091707622544385946774946875845624",
"144387105511575598457876558038993250780",
"162837650456278016619040382711550146920",
"6765641804440571231391549163726134091",
"88809560730868689537785665455917566860",
"301413192370373409162843665530761644407",
"8663664540742757081226336159702087543",
"55396036325060141824406712543143836531",
"80892279917008486933638197384647057029",
"90878923158905423537968859365544846986",
"24109282392511675122412015066732555133",
"267987946135103041813562499914543548785",
"46570669055090829139903672947831538697",
"163646641803072751357397526448310125418",
"69432951356938052394415641795502806477",
"200649715582688719422715792637989252008",
"157834423219453983464559793422820129713",
"216092648765066716740110058885071544276",
"284558818902349782864407212919896761238",
"280436051060498590488003276166476411196",
"119972468625763813745854130620452258389",
"172473620327172217443917015324700550573"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2eac8b14ac690aa73052aa6d4ba69005715367e",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
}
},
{
"id": "CVE-2024-58079-e2fe63a0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"286993007120515829649865086713396177184",
"118132717796359075100426228494644901970",
"274363091707622544385946774946875845624",
"144387105511575598457876558038993250780",
"162837650456278016619040382711550146920",
"6765641804440571231391549163726134091",
"88809560730868689537785665455917566860",
"301413192370373409162843665530761644407",
"112123826381321699840434806274754260230",
"267041682154829989697802233906281000560",
"80892279917008486933638197384647057029",
"90878923158905423537968859365544846986",
"24109282392511675122412015066732555133",
"267987946135103041813562499914543548785",
"46570669055090829139903672947831538697",
"163646641803072751357397526448310125418",
"69432951356938052394415641795502806477",
"200649715582688719422715792637989252008",
"157834423219453983464559793422820129713",
"216092648765066716740110058885071544276",
"284558818902349782864407212919896761238",
"280436051060498590488003276166476411196",
"119972468625763813745854130620452258389",
"172473620327172217443917015324700550573"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5",
"target": {
"file": "drivers/media/usb/uvc/uvc_driver.c"
}
}
]