Bug 2348513 (CVE-2024-58002)

Summary:	CVE-2024-58002 kernel: media: uvcvideo: Remove dangling pointers
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A dangling pointer vulnerability was found in the Linux kernel. When an async control is written, a copy of a pointer is made in the file handle that started the operation. If the user closes that file descriptor, its structure will be freed and there will be one dangling pointer per pending async control that the driver will try to use, leading to denial of service of the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-02-27 03:01:22 UTC

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Remove dangling pointers

When an async control is written, we copy a pointer to the file handle
that started the operation. That pointer will be used when the device is
done. Which could be anytime in the future.

If the user closes that file descriptor, its structure will be freed,
and there will be one dangling pointer per pending async control, that
the driver will try to use.

Clean all the dangling pointers during release().

To avoid adding a performance penalty in the most common case (no async
operation), a counter has been introduced with some logic to make sure
that it is properly handled.

Comment 1 Michal Findra 2025-02-27 13:59:44 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025022654-CVE-2024-58002-6f93@gregkh/T

Comment 6 errata-xmlrpc 2025-07-16 05:45:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11299 https://access.redhat.com/errata/RHSA-2025:11299

Comment 7 errata-xmlrpc 2025-07-16 05:58:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:11298 https://access.redhat.com/errata/RHSA-2025:11298

Comment 10 errata-xmlrpc 2025-07-21 03:56:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:11411 https://access.redhat.com/errata/RHSA-2025:11411

Comment 11 errata-xmlrpc 2025-07-21 09:00:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:11428 https://access.redhat.com/errata/RHSA-2025:11428

Comment 13 errata-xmlrpc 2025-08-05 15:48:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:13029 https://access.redhat.com/errata/RHSA-2025:13029

Comment 14 errata-xmlrpc 2025-08-05 15:55:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:13030 https://access.redhat.com/errata/RHSA-2025:13030

Comment 15 errata-xmlrpc 2025-08-05 17:57:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:13061 https://access.redhat.com/errata/RHSA-2025:13061

Comment 16 errata-xmlrpc 2025-08-06 05:16:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:13120 https://access.redhat.com/errata/RHSA-2025:13120

Comment 17 errata-xmlrpc 2025-08-06 07:51:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:13135 https://access.redhat.com/errata/RHSA-2025:13135

Comment 18 errata-xmlrpc 2025-08-11 14:17:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:13633 https://access.redhat.com/errata/RHSA-2025:13633

Comment 19 errata-xmlrpc 2025-08-13 02:41:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:13776 https://access.redhat.com/errata/RHSA-2025:13776

Comment 20 errata-xmlrpc 2025-08-13 09:36:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:13781 https://access.redhat.com/errata/RHSA-2025:13781