Vulnerability record · CVE-2024-53104 · published 2 December 2024
CVE-2024-53104: Linux kernel uvcvideo out-of-bounds write in frame parsing
Debian · Debian Linux
The Linux kernel uvcvideo driver fails to account for frames of type UVC_VS_UNDEFINED when sizing the frames buffer in uvc_parse_streaming, so uvc_parse_format can write past the end of that buffer. The flaw is an out-of-bounds write in a USB video class driver and is listed in CISA KEV, so it warrants prompt patching.
Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is a kernel out-of-bounds write with high integrity and confidentiality impact and confirmed inclusion in CISA KEV, though exploitation requires local USB device access.
What it is
The Linux kernel uvcvideo driver fails to account for frames of type UVC_VS_UNDEFINED when sizing the frames buffer in uvc_parse_streaming, so uvc_parse_format can write past the end of that buffer. The flaw is an out-of-bounds write in a USB video class driver and is listed in CISA KEV, so it warrants prompt patching.
Impact
An attacker who can supply a crafted USB video device descriptor gains out-of-bounds write in kernel memory, which can corrupt kernel data and potentially lead to code execution or privilege escalation in kernel context.
Attack surface
Reached locally through a malicious or spoofed USB video class device attached to the host; the CVSS vector requires local access and low privileges, with no user interaction. No remote or network path is described.
Exploitation
CVE-2024-53104 is listed in CISA KEV with a 2025-02-26 remediation due date, indicating known exploitation, while EPSS is 0.03395 (88th percentile). No ransomware campaign use is documented.
What to do
- Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits and update to a fixed kernel version.
- For Debian, apply the fixes announced in the Debian LTS advisories and reboot into the patched kernel.
- Restrict physical USB access to trusted devices and personnel on sensitive hosts.
- Where patching is not yet possible, follow CISA KEV guidance to apply vendor mitigations or discontinue use of the affected product.
Detection
- Monitor kernel logs for uvcvideo errors or warnings around USB video device enumeration.
- Alert on unexpected or unauthorized USB video class devices attached to production hosts.
- Track kernel versions against the fixed stable releases to find unpatched systems.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2024-53104 to the Known Exploited Vulnerabilities catalog on 5 February 2025 as "Linux Kernel Out-of-Bounds Write Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 26 February 2025.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2024-53104 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-53104), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
