CVE-2024-35830

MEDIUM

Linux Kernel 4.3-6.8.1 - Unauthenticated Device Access via v4l2 Async Registration

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.

References (11)

Core 11
Core References

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 5.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (30)
debian/debian_linux 10.0
linux/Kernel 4.20.0 - 5.4.273linux
linux/Kernel 4.3.0 - 4.19.311linux
linux/Kernel 5.11.0 - 5.15.153linux
linux/Kernel 5.16.0 - 6.1.83linux
linux/Kernel 5.5.0 - 5.10.214linux
linux/Kernel 6.2.0 - 6.6.23linux
linux/Kernel 6.7.0 - 6.7.11linux
linux/Kernel 6.8.0 - 6.8.2linux
Linux/Linux < 4.3
... and 20 more
Published May 17, 2024
Tracked Since Feb 18, 2026