CVE-2024-58002

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58002", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:04:28.915Z", "datePublished": "2025-02-27T02:12:00.223Z", "dateUpdated": "2026-10-15T21:51:50.424Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:20.198Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached entirely through local syscalls on the video character device \u2014 VIDIOC_S_EXT_CTRLS followed by close() on /dev/videoN. No physical access or device insertion is needed since the camera is already attached and its normal async-control interrupt drives the use of the stale pointer.\nAC:L - The attacker controls both halves: they choose when to set the asynchronous control and when to close the fd, and can spray the generic kmalloc slab to reclaim the freed uvc_fh before the status event fires. The use can even be forced synchronously in the same close() via uvc_status_put()->uvc_status_stop()->cancel_work_sync(), and the whole sequence is freely repeatable.\nPR:L - Only read/write access to /dev/videoN is required \u2014 no capability check exists anywhere on the uvc_ctrl_set/commit path. That access is granted to the ordinary logged-in user via logind ACLs or the video group, and to unprivileged camera services on Android/ChromeOS.\nUI:N - The attacker performs every step themselves \u2014 open, set async control, close \u2014 with no victim action required. The control-change interrupt that consumes the dangling pointer is autonomous device behaviour.\nS:U - The freed object and the code that uses it are both kernel-resident in the uvcvideo driver; no VM, IOMMU, or sandbox boundary is crossed. This is a standard same-authority kernel memory-safety defect.\nC:H - A pointer to a freed uvc_fh persists in device-scoped uvc_control state and is reclaimable at will from unprivileged userspace, so the driver operates on an attacker- or victim-controlled aliased slab object treated as a struct v4l2_fh. Consistent with use-after-free scoring, this yields high confidentiality impact through control over freed-object contents and leakage of another handle's control-event stream.\nI:H - The stale pointer is the identity token gating event routing, so reclaiming the slot lets an attacker corrupt which file handles receive control-change notifications and type-confuse the reallocated object. Use-after-free conditions of this kind are scored as enabling heap-spray-based write primitives and control-flow corruption.\nA:H - One dangling pointer is left per pending async control in long-lived per-device structures, and the driver subsequently consumes it \u2014 a use-after-free that can crash or destabilize the kernel, and which the attacker can re-arm indefinitely by looping open/set/close."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "versions": [{"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "2a29413ace64627e178fd422dd8a5d95219a2c0b", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "653993f46861f2971e95e9a0e36a34b49dec542c", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "ac18d781466252cd35a3e311e0a4b264260fd927", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "4dbaa738c583a0e947803c69e8996e88cf98d971", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "438bda062b2c40ddd7df23b932e29ffe0a448cac", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "9edc7d25f7e49c33a1ce7a5ffadea2222065516c", "status": "affected", "versionType": "git"}, {"version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "221cd51efe4565501a3dbf04cc011b537dcce7fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.291", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.235", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.130", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.80", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.4.291"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.235"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.179"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.13.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b"}, {"url": "https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c"}, {"url": "https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50"}, {"url": "https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927"}, {"url": "https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971"}, {"url": "https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac"}, {"url": "https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c"}, {"url": "https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb"}], "title": "media: uvcvideo: Remove dangling pointers", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:33:15.914Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:01:17.126Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:06.709133Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:50.424Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:33:15.914Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:01:17.126Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58002", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:06.709133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:07.367Z"}}], "cna": {"title": "media: uvcvideo: Remove dangling pointers", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached entirely through local syscalls on the video character device \u2014 VIDIOC_S_EXT_CTRLS followed by close() on /dev/videoN. No physical access or device insertion is needed since the camera is already attached and its normal async-control interrupt drives the use of the stale pointer.\nAC:L - The attacker controls both halves: they choose when to set the asynchronous control and when to close the fd, and can spray the generic kmalloc slab to reclaim the freed uvc_fh before the status event fires. The use can even be forced synchronously in the same close() via uvc_status_put()->uvc_status_stop()->cancel_work_sync(), and the whole sequence is freely repeatable.\nPR:L - Only read/write access to /dev/videoN is required \u2014 no capability check exists anywhere on the uvc_ctrl_set/commit path. That access is granted to the ordinary logged-in user via logind ACLs or the video group, and to unprivileged camera services on Android/ChromeOS.\nUI:N - The attacker performs every step themselves \u2014 open, set async control, close \u2014 with no victim action required. The control-change interrupt that consumes the dangling pointer is autonomous device behaviour.\nS:U - The freed object and the code that uses it are both kernel-resident in the uvcvideo driver; no VM, IOMMU, or sandbox boundary is crossed. This is a standard same-authority kernel memory-safety defect.\nC:H - A pointer to a freed uvc_fh persists in device-scoped uvc_control state and is reclaimable at will from unprivileged userspace, so the driver operates on an attacker- or victim-controlled aliased slab object treated as a struct v4l2_fh. Consistent with use-after-free scoring, this yields high confidentiality impact through control over freed-object contents and leakage of another handle's control-event stream.\nI:H - The stale pointer is the identity token gating event routing, so reclaiming the slot lets an attacker corrupt which file handles receive control-change notifications and type-confuse the reallocated object. Use-after-free conditions of this kind are scored as enabling heap-spray-based write primitives and control-flow corruption.\nA:H - One dangling pointer is left per pending async control in long-lived per-device structures, and the driver subsequently consumes it \u2014 a use-after-free that can crash or destabilize the kernel, and which the attacker can re-arm indefinitely by looping open/set/close."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "2a29413ace64627e178fd422dd8a5d95219a2c0b", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "653993f46861f2971e95e9a0e36a34b49dec542c", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "ac18d781466252cd35a3e311e0a4b264260fd927", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "4dbaa738c583a0e947803c69e8996e88cf98d971", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "438bda062b2c40ddd7df23b932e29ffe0a448cac", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "9edc7d25f7e49c33a1ce7a5ffadea2222065516c", "versionType": "git"}, {"status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "lessThan": "221cd51efe4565501a3dbf04cc011b537dcce7fb", "versionType": "git"}], "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.291", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.235", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.179", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.130", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.80", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.14", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.3", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b"}, {"url": "https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c"}, {"url": "https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50"}, {"url": "https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927"}, {"url": "https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971"}, {"url": "https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac"}, {"url": "https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c"}, {"url": "https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.291", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.235", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.179", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.130", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.80", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.14", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.3", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "4.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:20.198Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58002", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:50.424Z", "dateReserved": "2025-02-27T02:04:28.915Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-02-27T02:12:00.223Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2a29413ace64627e178fd422dd8a5d95219a2c0b", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "653993f46861f2971e95e9a0e36a34b49dec542c", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "ac18d781466252cd35a3e311e0a4b264260fd927", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "4dbaa738c583a0e947803c69e8996e88cf98d971", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "438bda062b2c40ddd7df23b932e29ffe0a448cac", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "9edc7d25f7e49c33a1ce7a5ffadea2222065516c", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}, {"lessThan": "221cd51efe4565501a3dbf04cc011b537dcce7fb", "status": "affected", "version": "e5225c820c057537dc780244760e2e24c7d27366", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/usb/uvc/uvc_ctrl.c", "drivers/media/usb/uvc/uvc_v4l2.c", "drivers/media/usb/uvc/uvcvideo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.291", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.235", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.179", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.130", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.80", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.14", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "75080FCA-11DD-4E2C-BD8B-593BA4A9E12D", "versionEndExcluding": "6.6.80", "versionStartIncluding": "4.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "033BB7EE-C9A2-45EA-BAC9-87BB9D951BCD", "versionEndExcluding": "6.12.14", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00", "versionEndExcluding": "6.13.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Remove dangling pointers\n\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\n\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\n\nClean all the dangling pointers during release().\n\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: uvcvideo: Eliminar punteros colgantes Cuando se escribe un control as\u00edncrono, copiamos un puntero al identificador de archivo que inici\u00f3 la operaci\u00f3n. Ese puntero se utilizar\u00e1 cuando el dispositivo termine. Lo que podr\u00eda ser en cualquier momento en el futuro. Si el usuario cierra ese descriptor de archivo, se liberar\u00e1 su estructura y habr\u00e1 un puntero colgante por cada control as\u00edncrono pendiente, que el controlador intentar\u00e1 utilizar. Limpie todos los punteros colgantes durante release(). Para evitar agregar una penalizaci\u00f3n de rendimiento en el caso m\u00e1s com\u00fan (sin operaci\u00f3n as\u00edncrona), se ha introducido un contador con cierta l\u00f3gica para asegurarse de que se gestiona correctamente."}], "id": "CVE-2024-58002", "lastModified": "2026-10-15T22:18:05.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58002", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:06.709133Z", "version": "2.0.3"}}]}, "published": "2025-02-27T03:15:11.180", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/221cd51efe4565501a3dbf04cc011b537dcce7fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a29413ace64627e178fd422dd8a5d95219a2c0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/438bda062b2c40ddd7df23b932e29ffe0a448cac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4dbaa738c583a0e947803c69e8996e88cf98d971"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/653993f46861f2971e95e9a0e36a34b49dec542c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9edc7d25f7e49c33a1ce7a5ffadea2222065516c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ac18d781466252cd35a3e311e0a4b264260fd927"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: uvcvideo: Remove dangling pointers", "id": "2348513", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348513"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: uvcvideo: Remove dangling pointers\nWhen an async control is written, we copy a pointer to the file handle\nthat started the operation. That pointer will be used when the device is\ndone. Which could be anytime in the future.\nIf the user closes that file descriptor, its structure will be freed,\nand there will be one dangling pointer per pending async control, that\nthe driver will try to use.\nClean all the dangling pointers during release().\nTo avoid adding a performance penalty in the most common case (no async\noperation), a counter has been introduced with some logic to make sure\nthat it is properly handled.", "A dangling pointer vulnerability was found in the Linux kernel. When an async control is written, a copy of a pointer is made in the file handle that started the operation. If the user closes that file descriptor, its structure will be freed and there will be one dangling pointer per pending async control that the driver will try to use, leading to denial of service of the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-58002", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58002\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58002\nhttps://lore.kernel.org/linux-cve-announce/2025022654-CVE-2024-58002-6f93@gregkh/T"], "threat_severity": "Moderate"}

{}