CVE-2024-53104highunder attackCWE-787

CVE-2024-53104: high-severity vulnerability in Linux

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Published · Updated

Follow this CVE+ Monitor Linux+ Monitor linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.8epss 3.4%
from disclosure to weapon
Published on NVDDec 2
CISA KEV+65d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (23 components)
Red Hat Enterprise Linux 9 · Red Hat OpenShift Container Platform 4
workaround: This flaw can be mitigated by preventing the `uvcvideo` module from loading. See "How do I prevent a kernel module from loading automatically?"[1] for more information…
Fixed
53 products (2,855 components)
Red Hat OpenShift Container Platform 4.18 · Red Hat Enterprise Linux BaseOS EUS (v.9.4) · Red Hat Enterprise Linux BaseOS EUS (v.9.2) · Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat Enterprise Linux BaseOS (v. 8) · and others 48
fix ↗
Not affected
6 products (3,017 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.15 · Red Hat OpenShift Container Platform 4.16 · Red Hat OpenShift Container Platform 4.17 · Red Hat OpenShift Container Platform 4.13 · and others 1
Action required by CISAfederal deadline: 2025-02-26

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A flaw in the Linux kernel's USB video driver fails to properly handle certain undefined frame types, which can cause the driver to write data outside allocated memory boundaries. This can crash the system or potentially allow unauthorized code execution when a malicious USB device is connected.

Technical detail

CWE-787 out-of-bounds write vulnerability in uvc_parse_format() where UVC_VS_UNDEFINED frame types are parsed but not accounted for in buffer size calculation in uvc_parse_streaming(). Attack vector requires physical connection of a crafted USB video device; impact includes memory corruption and potential code execution in kernel context.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Linux · Linux
Related CVEs — Linux

In the same product, most dangerous first.

CVE-2026-31431HIGHcrypto: algif_aead - Revert to operating out-of-placeEPSS 98.1%KEVCVE-2026-46300HIGHnet: skbuff: preserve shared-frag marker during coalescingEPSS 16.1%KEVCVE-2024-53197HIGHALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesEPSS 4.1%KEVCVE-2025-39682CRITICALtls: fix handling of zero-length records on the rx_listEPSS 3.3%KEVCVE-2024-36971HIGHnet: fix __dst_negative_advice() raceEPSS 2.7%KEVCVE-2025-39964HIGHcrypto: af_alg - Disallow concurrent writes in af_alg_sendmsgEPSS 1.6%KEV