CVE-2024-58079

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58079", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-06T15:52:09.183Z", "datePublished": "2025-03-06T16:13:42.640Z", "dateUpdated": "2026-10-15T21:51:50.721Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:35.196Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker's action is entirely local \u2014 unbinding uvcvideo from the USB interface via the usbfs `USBDEVFS_DISCONNECT` ioctl on `/dev/bus/usb/BBB/DDD`, a sysfs `unbind` write, or `rmmod`, followed by local heap grooming. No network or adjacent-network input reaches this code, and no device insertion is needed since the camera is already attached.\nAC:L - The unbind deterministically leaves the IRQ registered against the freed `uvc_device` with no race window \u2014 the dangling registration persists indefinitely until the next privacy-line transition, and the IRQ is armed on both edges (`IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING`). Reclaiming the freed `uvc_device`/`uvc_entity` slabs is ordinary attacker-controlled heap spraying, not a condition outside the attacker's influence.\nPR:L - `usbdev_do_ioctl()` performs no capability check at all \u2014 `USBDEVFS_DISCONNECT` needs only write access to the usbfs node, which is routinely granted to unprivileged users on systems running libusb/libuvc camera userspace (libusb's `detach_kernel_driver` is implemented with this exact ioctl) and to containers given `/dev/bus/usb` passthrough. So a basic unprivileged local account, not real root, is sufficient to free the object while the IRQ stays armed.\nUI:N - No victim action is required for the attack itself: the attacker performs the unbind and the heap spray, and the stale IRQ remains armed indefinitely so the next privacy-switch/camera-mute transition \u2014 which the attacker on these laptop/Chromebook form factors can cause directly, and which occurs in normal operation regardless \u2014 fires the freed handler.\nS:U - The use-after-free corrupts kernel heap memory and hijacks control flow within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The handler reads a fully attacker-reclaimable freed `uvc_device` and `uvc_entity`, and `gpiod_get_raw_value_commit()` dereferences the attacker-controlled `gpio_desc *` chain (`desc->gdev` \u2192 `gdev->chip`), giving an arbitrary-read primitive and, via the resulting controlled indirect call, disclosure of arbitrary kernel memory.\nI:H - `gc->get(gc, offset)` is an indirect call through a function pointer sourced from reclaimed heap contents, and `uvc_ctrl_status_event()` performs `mutex_lock()` and list manipulation on a bogus `chain` from the freed `dev->chains` head \u2014 together an arbitrary-write and code-execution primitive; after `rmmod` the IRQ action even points into unloaded module text.\nA:H - As the commit states, an IRQ after unbind \"will try to access memory sections that are already free, causing an OOPS\" \u2014 a kernel panic/crash on the affected device, and any unexploited attempt reliably crashes the machine."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "versions": [{"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0fdd7cc593385e46e92e180b71e264fc9c195298", "status": "affected", "versionType": "git"}, {"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "3c00e94d00ca079bef7906d6f39d1091bccfedd3", "status": "affected", "versionType": "git"}, {"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9", "status": "affected", "versionType": "git"}, {"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "d2eac8b14ac690aa73052aa6d4ba69005715367e", "status": "affected", "versionType": "git"}, {"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d", "status": "affected", "versionType": "git"}, {"version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.130", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.78", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.179"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.13.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0fdd7cc593385e46e92e180b71e264fc9c195298"}, {"url": "https://git.kernel.org/stable/c/3c00e94d00ca079bef7906d6f39d1091bccfedd3"}, {"url": "https://git.kernel.org/stable/c/0b5e0445bc8384c18bd35cb9fe87f6258c6271d9"}, {"url": "https://git.kernel.org/stable/c/d2eac8b14ac690aa73052aa6d4ba69005715367e"}, {"url": "https://git.kernel.org/stable/c/5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d"}, {"url": "https://git.kernel.org/stable/c/a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5"}], "title": "media: uvcvideo: Fix crash during unbind if gpio unit is in use", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:34:12.917Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:01:45.269Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:13.037875Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:51:50.721Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:34:12.917Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:01:45.269Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58079", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:42:13.037875Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:42:13.843Z"}}], "cna": {"title": "media: uvcvideo: Fix crash during unbind if gpio unit is in use", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker's action is entirely local \u2014 unbinding uvcvideo from the USB interface via the usbfs `USBDEVFS_DISCONNECT` ioctl on `/dev/bus/usb/BBB/DDD`, a sysfs `unbind` write, or `rmmod`, followed by local heap grooming. No network or adjacent-network input reaches this code, and no device insertion is needed since the camera is already attached.\nAC:L - The unbind deterministically leaves the IRQ registered against the freed `uvc_device` with no race window \u2014 the dangling registration persists indefinitely until the next privacy-line transition, and the IRQ is armed on both edges (`IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING`). Reclaiming the freed `uvc_device`/`uvc_entity` slabs is ordinary attacker-controlled heap spraying, not a condition outside the attacker's influence.\nPR:L - `usbdev_do_ioctl()` performs no capability check at all \u2014 `USBDEVFS_DISCONNECT` needs only write access to the usbfs node, which is routinely granted to unprivileged users on systems running libusb/libuvc camera userspace (libusb's `detach_kernel_driver` is implemented with this exact ioctl) and to containers given `/dev/bus/usb` passthrough. So a basic unprivileged local account, not real root, is sufficient to free the object while the IRQ stays armed.\nUI:N - No victim action is required for the attack itself: the attacker performs the unbind and the heap spray, and the stale IRQ remains armed indefinitely so the next privacy-switch/camera-mute transition \u2014 which the attacker on these laptop/Chromebook form factors can cause directly, and which occurs in normal operation regardless \u2014 fires the freed handler.\nS:U - The use-after-free corrupts kernel heap memory and hijacks control flow within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The handler reads a fully attacker-reclaimable freed `uvc_device` and `uvc_entity`, and `gpiod_get_raw_value_commit()` dereferences the attacker-controlled `gpio_desc *` chain (`desc->gdev` \u2192 `gdev->chip`), giving an arbitrary-read primitive and, via the resulting controlled indirect call, disclosure of arbitrary kernel memory.\nI:H - `gc->get(gc, offset)` is an indirect call through a function pointer sourced from reclaimed heap contents, and `uvc_ctrl_status_event()` performs `mutex_lock()` and list manipulation on a bogus `chain` from the freed `dev->chains` head \u2014 together an arbitrary-write and code-execution primitive; after `rmmod` the IRQ action even points into unloaded module text.\nA:H - As the commit states, an IRQ after unbind \"will try to access memory sections that are already free, causing an OOPS\" \u2014 a kernel panic/crash on the affected device, and any unexploited attempt reliably crashes the machine."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0fdd7cc593385e46e92e180b71e264fc9c195298", "versionType": "git"}, {"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "3c00e94d00ca079bef7906d6f39d1091bccfedd3", "versionType": "git"}, {"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9", "versionType": "git"}, {"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "d2eac8b14ac690aa73052aa6d4ba69005715367e", "versionType": "git"}, {"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d", "versionType": "git"}, {"status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "lessThan": "a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5", "versionType": "git"}], "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.179", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.130", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.78", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.14", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13.3", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0fdd7cc593385e46e92e180b71e264fc9c195298"}, {"url": "https://git.kernel.org/stable/c/3c00e94d00ca079bef7906d6f39d1091bccfedd3"}, {"url": "https://git.kernel.org/stable/c/0b5e0445bc8384c18bd35cb9fe87f6258c6271d9"}, {"url": "https://git.kernel.org/stable/c/d2eac8b14ac690aa73052aa6d4ba69005715367e"}, {"url": "https://git.kernel.org/stable/c/5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d"}, {"url": "https://git.kernel.org/stable/c/a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.179", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.130", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.78", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.14", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.3", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:35.196Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58079", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:51:50.721Z", "dateReserved": "2025-03-06T15:52:09.183Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-06T16:13:42.640Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0fdd7cc593385e46e92e180b71e264fc9c195298", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}, {"lessThan": "3c00e94d00ca079bef7906d6f39d1091bccfedd3", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}, {"lessThan": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}, {"lessThan": "d2eac8b14ac690aa73052aa6d4ba69005715367e", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}, {"lessThan": "5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}, {"lessThan": "a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5", "status": "affected", "version": "2886477ff98740cc3333cf785e4de0b1ff3d7a28", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/usb/uvc/uvc_driver.c", "drivers/media/usb/uvc/uvcvideo.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.179", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.130", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.78", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.14", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8D59378-B1BE-4F89-B688-A1FCE28B723F", "versionEndExcluding": "5.15.179", "versionStartIncluding": "5.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26997835-273D-4841-ABD3-4696059AC299", "versionEndExcluding": "6.1.130", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C58261F-EDFB-4A12-8CCD-F12101482030", "versionEndExcluding": "6.6.78", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "033BB7EE-C9A2-45EA-BAC9-87BB9D951BCD", "versionEndExcluding": "6.12.14", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00", "versionEndExcluding": "6.13.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: uvcvideo: Se corrige el fallo durante la desvinculaci\u00f3n si la unidad gpio est\u00e1 en uso. Usamos el dispositivo incorrecto para las funciones administradas por el dispositivo. Usamos el dispositivo usb, cuando deber\u00edamos estar usando el dispositivo de interfaz. Si desvinculamos el controlador de la interfaz usb, las funciones de limpieza nunca se llaman. En nuestro caso, la IRQ nunca se deshabilita. Si se activa una IRQ, intentar\u00e1 acceder a secciones de memoria que ya est\u00e1n libres, lo que provocar\u00e1 un OOPS. No podemos usar la funci\u00f3n devm_request_threaded_irq aqu\u00ed. Las funciones de limpieza devm_* pueden llamarse despu\u00e9s de que uvc_delete libere la estructura principal. Afortunadamente, este error tiene un impacto peque\u00f1o, ya que solo se ve afectado por dispositivos con unidades gpio y el usuario tiene que desvincular el dispositivo, una desconexi\u00f3n no activar\u00e1 este error."}], "id": "CVE-2024-58079", "lastModified": "2026-10-15T22:18:05.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58079", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:42:13.037875Z", "version": "2.0.3"}}]}, "published": "2025-03-06T17:15:21.360", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b5e0445bc8384c18bd35cb9fe87f6258c6271d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0fdd7cc593385e46e92e180b71e264fc9c195298"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3c00e94d00ca079bef7906d6f39d1091bccfedd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d2e65cbe53d0141ed095cf31c2dcf3d8668c11d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d2eac8b14ac690aa73052aa6d4ba69005715367e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: uvcvideo: Fix crash during unbind if gpio unit is in use", "id": "2350383", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2350383"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: uvcvideo: Fix crash during unbind if gpio unit is in use\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error."], "name": "CVE-2024-58079", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58079\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58079\nhttps://lore.kernel.org/linux-cve-announce/2025030609-CVE-2024-58079-f973@gregkh/T"], "threat_severity": "Low"}

{"created": "2025-07-12T22:01:05.165532+00:00", "updated": "2025-07-12T22:01:05.165662+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}