CVE-2024-57980

Summary

CVE-2024-57980 is a vulnerability affecting the Linux kernel's media driver for UVC video devices. The issue arises when the uvc_status_init() function fails to allocate memory for int_urb, causing it to free the dev->status pointer without resetting it to NULL. Consequently, the kfree() call in uvc_status_cleanup() attempts to double-free the same memory, leading to potential memory corruption. This vulnerability has been addressed by resetting the dev->status pointer to NULL after freeing it. The issue was reviewed by Ricardo Ribalda from Chromium.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.