Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-57980

media: uvcvideo: Fix double free in error path

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.76, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. This results in the kfree() call in uvc_status_cleanup() trying to double-free the memory. Fix it by resetting the dev->status pointer to NULL after freeing it. Reviewed by: Ricardo Ribalda <ribalda@chromium.org>

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in d6e5ba2516c5bef87c1fcb8189b6f3cad7c64b2d; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in 87522ef165e5b6de8ef98cc318f3335166a1512c; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in 3ba8884a56a3eb97c22f0ce0e4dd410d4ca4c277; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in 9232719ac9ce4d5c213cebda23d72aec3e1c4c0d; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in 6c36dcd662ec5276782838660f8533a7cb26be49; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in d1f8e69eec91d5a75ef079778a5d0151db2a7f22; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in d8e63dd7b6683969d3d47c7b8e9635f96d554ad4; From a31a4055473bf0a7b2b06cb2262347200d0711e1 · fixed in c6ef3a7fa97ec823a1e1af9085cf13db9f7b3bac

  • Linux Linux

    2.6.28

  • KernelLinux

    From 2.6.28 · fixed in 5.4.291; From 5.5.0 · fixed in 5.10.235; From 5.11.0 · fixed in 5.15.179; From 5.16.0 · fixed in 6.1.129; From 6.2.0 · fixed in 6.6.76; From 6.7.0 · fixed in 6.12.13; From 6.13.0 · fixed in 6.13.2

References 8

git.kernel.org