Linux Kernel Vulnerability in UVC Video Driver Affecting Memory Management

CVE-2024-57980

What is CVE-2024-57980?

A vulnerability has been identified in the Linux kernel's uvcvideo driver, where a failure in the uvc_status_init() function can lead to a double-free error. Specifically, when the function fails to allocate the int_urb, it frees the dev->status pointer without resetting it to NULL. Consequently, this oversight can cause the kfree() call in the uvc_status_cleanup() function to attempt to free the same memory twice, potentially resulting in undefined behavior. The issue has been addressed by ensuring the pointer is set to NULL after freeing, thus enhancing the driver’s stability and security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References