ZeroDay Findings
Sign inSign up

Findings

CVE-2024-53104

Linux Kernel Out-of-Bounds Write Vulnerability

Published Dec 2, 2024 · updated Jun 17, 2026 · debian debian linux

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 2, 2024 · Catalog

    Detected

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

  2. Feb 5, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Feb 26, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Feb 26, 2025

Affected

  • cpe debian/debian linux11.0
  • cpe linux/linux kernelversion unspecified
  • vendor Linux Kernelversion unspecified

Sources

  • CISA KEVCVE-2024-53104

    Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.

    cisa.gov
  • CVE.orgCVE-2024-53104

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-53104

    30-day exploitation probability 3.4%

    first.org
  • NIST NVDCVE-2024-53104

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the fra

    nvd.nist.gov

References