CVE-2024-53104
Linux Kernel Out-of-Bounds Write Vulnerability
Description
CVE-2024-53104 is a high-severity out-of-bounds write vulnerability in the Linux kernel's USB Video Class (UVC) driver that allows a locally authenticated attacker to escalate privileges. With a CVSS v3.1 base score of 7.8, the flaw exists in the uvc_parse_format function within the uvcvideo module, where frames of type UVC_VS_UNDEFINED are not properly accounted for when calculating buffer sizes, leading to heap-based memory corruption. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 26, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 11.09% at the 93.3rd percentile indicates substantial exploitation probability, placing it well above average for tracked vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| debian | debian linux | 11.0 |
| linux | linux kernel | >= 2.6.26, < 4.19.324; >= 4.20, < 5.4.286; >= 5.5, < 5.10.230; >= 5.11, < 5.15.172; >= 5.16, < 6.1.117; >= 6.2, < 6.6.61; >= 6.7, < 6.11.8; >= 6.12, < 6.12.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4f(Patch)
- https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29(Patch)
- https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91d(Patch)
- https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5(Patch)
- https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204ae(Patch)
- https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8(Patch)
- https://git.kernel.org/stable/c/beced2cb09b58c1243733f374c560a55382003d6(Patch)
- https://git.kernel.org/stable/c/ecf2b43018da9579842c774b7f35dbe11b5c38dd(Patch)
- https://git.kernel.org/stable/c/faff5bbb2762c44ec7426037b3000e77a11d6773(Patch)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html(Mailing List)
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53104(US Government Resource)
Weakness Type
Unknown CWE
CVE-2024-53104 does not have a specific CWE assigned in the NVD database, but the underlying vulnerability is an out-of-bounds write caused by incorrect buffer size calculation. The Linux kernel's UVC video driver parses video streaming format descriptors from USB devices to determine frame buffer sizes. The uvc_parse_streaming function calculates how much memory to allocate for frame descriptors, but it does not account for frames with the type UVC_VS_UNDEFINED. When uvc_parse_format subsequently processes these undefined frame types, it writes frame data beyond the allocated buffer boundary. This heap-based out-of-bounds write can corrupt adjacent kernel memory structures, enabling privilege escalation from a local attacker who can connect a malicious USB device or otherwise trigger the vulnerable code path. Learn more about out-of-bounds write vulnerabilities
Impact Analysis
The impact of CVE-2024-53104 spans all three dimensions of the CIA triad with high severity ratings. Confidentiality is fully compromised because successful exploitation grants kernel-level code execution, enabling the attacker to read any data in kernel memory including cryptographic keys, credentials, and data belonging to other processes and users on the system.
Integrity suffers maximum impact as kernel-level execution allows the attacker to modify any file, process, or kernel structure on the system. This includes the ability to install rootkits that persist across reboots, tamper with security mechanisms such as SELinux or AppArmor, modify system call tables to intercept operations, and alter audit logs to erase evidence of compromise.
Availability is critically threatened because kernel memory corruption can cause immediate system crashes, and controlled exploitation provides the capability to terminate processes, disable services, or deploy destructive payloads. The EPSS score of 11.09% at the 93.3rd percentile confirms significant real-world exploitation activity. The vulnerability affects Linux kernel versions dating back to 2.6.26, spanning an extremely wide range of deployed systems including Debian 11 and numerous kernel branches up through version 6.12.1. The local attack vector requires physical USB access or the ability to trigger UVC device enumeration, but in environments where USB ports are accessible or where USB device passthrough is used in virtualized environments, the attack surface is substantial.
Exploit Maturity
CVE-2024-53104 demonstrates confirmed exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 26, 2025. The EPSS score of 11.09% at the 93.3rd percentile reflects significant exploitation activity, indicating that this vulnerability is being exploited more actively than approximately 93% of all tracked vulnerabilities. Multiple kernel patches have been released across all affected branches, available at the kernel.org stable repository.
The vulnerability has been present in the Linux kernel since version 2.6.26, giving it an extraordinarily large install base of potentially vulnerable systems. The out-of-bounds write primitive in kernel space is a well-understood exploitation technique among kernel exploit developers, and the UVC driver code path can be triggered by connecting a specially crafted USB device or by emulating one through USB gadget interfaces. Debian has issued advisories through the debian-lts-announce mailing list, and patches are available across eight stable kernel branches. The CISA KEV entry can be reviewed at the KEV catalog. While the ransomware association is classified as unknown, kernel privilege escalation vulnerabilities are frequently incorporated into advanced attack chains targeting Linux servers and embedded systems.
Remediation
-
Update the Linux kernel to a patched version immediately. The fix has been backported to the following stable branches: 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, and 6.12.1. Identify your current kernel version with
uname -rand upgrade to the appropriate patched release for your distribution. -
Apply distribution-specific security updates if you are running Debian, Ubuntu, RHEL, or other managed distributions. For Debian 11, the fix is available through the standard security update channel. Check your distribution's security advisory page and apply the relevant kernel package update using your package manager.
-
Restrict USB device access as an interim mitigation on systems where immediate kernel patching is not possible. Use USBGuard or udev rules to block unauthorized USB video devices from being enumerated. On servers and workstations that do not require USB webcam support, blacklist the uvcvideo kernel module with
echo "blacklist uvcvideo" >> /etc/modprobe.d/blacklist.conf. -
Monitor for exploitation indicators by reviewing kernel logs (dmesg) for unexpected UVC device enumeration events, crash dumps related to the uvcvideo module, or signs of heap corruption. Enable kernel crash dumping (kdump) to capture forensic data in case of exploitation attempts that result in kernel panics.
-
Reboot systems after kernel updates to ensure the patched kernel is running. Verify the active kernel version post-reboot with
uname -rand confirm it matches the expected patched version. For environments using live-patching solutions such as kpatch or Ksplice, verify that the relevant patch has been applied to the running kernel.
Technical Details
CVE-2024-53104 is an out-of-bounds write vulnerability in the Linux kernel's UVC video driver, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:L) indicates the attacker needs local access, typically through physical USB device connection or local code execution that can trigger USB device enumeration. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:L) indicates a low-privilege user account is sufficient to trigger the vulnerability. User Interaction (UI:N) confirms no additional user action is needed beyond the attacker's own activity. Scope (S:U) indicates the impact remains within the vulnerable kernel context, though kernel compromise effectively means full system compromise.
The vulnerability resides in the uvc_parse_format function within drivers/media/usb/uvc/uvc_driver.c. When the UVC driver parses streaming format descriptors from a connected USB video device, it first calculates the total number of frame descriptors in uvc_parse_streaming to allocate an appropriately sized buffer. However, this calculation does not account for frame descriptors with subtype UVC_VS_UNDEFINED (value 0x00). When uvc_parse_format subsequently iterates through the frame descriptors and encounters UVC_VS_UNDEFINED frames, it writes frame data into the buffer without bounds checking, causing a heap-based out-of-bounds write. The fix adds an explicit skip for UVC_VS_UNDEFINED frame types in uvc_parse_format, preventing the write of undefined frames into the buffer. The affected kernel range spans from version 2.6.26 (released in 2008) through all versions prior to the patched releases across eight stable branches.
Frequently Asked Questions
What is CVE-2024-53104?
CVE-2024-53104 is a high-severity out-of-bounds write vulnerability in the Linux kernel's USB Video Class (UVC) driver. It allows a local attacker with low privileges to escalate to kernel-level access by exploiting a buffer size miscalculation when parsing UVC video stream format descriptors.
Which Linux kernel versions are affected by CVE-2024-53104?
The vulnerability affects Linux kernel versions from 2.6.26 through multiple branches up to 6.12.1. Patched versions include 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, and 6.12.1. Debian 11 is also confirmed as affected.
Can CVE-2024-53104 be exploited remotely?
No, CVE-2024-53104 requires local access to the target system. The most direct exploitation method involves connecting a malicious USB video device, though local code execution that can trigger USB device enumeration may also serve as an attack vector.
Is CVE-2024-53104 associated with ransomware?
CISA's KEV entry classifies the ransomware association as unknown. However, kernel privilege escalation vulnerabilities are valuable components in advanced attack chains, including those used by ransomware operators targeting Linux infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.