Linux Kernel Vulnerability in UVC Video Driver Affecting Memory Management

CVE-2024-57980

Summary

A vulnerability has been identified in the Linux kernel's uvcvideo driver, where a failure in the uvc_status_init() function can lead to a double-free error. Specifically, when the function fails to allocate the int_urb, it frees the dev->status pointer without resetting it to NULL. Consequently, this oversight can cause the kfree() call in the uvc_status_cleanup() function to attempt to free the same memory twice, potentially resulting in undefined behavior. The issue has been addressed by ensuring the pointer is set to NULL after freeing, thus enhancing the driver’s stability and security.

References