CVE-2024-53104

HIGHCISA KEV

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-53104 has a selected CVSS score of 7.8 (high); EIP currently links 1 repository PoC. CISA lists CVE-2024-53104 in KEV.

Description

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming.

Description source: CVE List

Exploitation context

Known exploitation

CISA KEV
Listed · Feb 5, 2025 · CISA
VulnCheck KEV
Listed · Nov 7, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 21, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Kernel

Browse Linux / Kernel
CISAVersion data not supplied

Linux

Browse Linux / Linux

Default status: unaffected, affected

CVE Listc0efd232929c2cd87238de2cccdaf4e845be5b0c to < 95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < 684022f81f128338fe3587ec967459669a1204aeaffected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < faff5bbb2762c44ec7426037b3000e77a11d6773affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < 467d84dc78c9abf6b217ada22b3fdba336262e29affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < beced2cb09b58c1243733f374c560a55382003d6affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < 575a562f7a3ec2d54ff77ab6810e3fbceef2a91daffected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < 622ad10aae5f5e03b7927ea95f7f32812f692bb5affected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < 1ee9d9122801eb688783acd07791f2906b87cb4faffected
c0efd232929c2cd87238de2cccdaf4e845be5b0c to < ecf2b43018da9579842c774b7f35dbe11b5c38ddaffected
2.6.26affected
Before 2.6.26unaffected
4.19.324 to ≤ 4.19.*unaffected
Showing 12 of 20 version ranges

Kernel

Browse Linux / Kernel
OSV2.6.26 to < 4.19.324 · Fixed in 4.19.324affected
4.20.0 to < 5.4.286 · Fixed in 5.4.286affected
5.5.0 to < 5.10.230 · Fixed in 5.10.230affected
5.11.0 to < 5.15.172 · Fixed in 5.15.172affected
5.16.0 to < 6.1.117 · Fixed in 6.1.117affected
6.2.0 to < 6.6.61 · Fixed in 6.6.61affected
6.7.0 to < 6.11.8 · Fixed in 6.11.8affected
6.12.0 to < 6.12.1 · Fixed in 6.12.1affected

Proofs of concept

1

Repository PoCs

GitHubruntimeverification/kernel-c-to-rust-spikeRepository PoCby runtimeverification0Writeup36 files

3.1 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a research spike demonstrating a C-to-Rust hardening loop for the Linux kernel UVC descriptor parser. It contains a byte-for-byte C extraction, a safe Rust rewrite, a differential fuzzer, and formal verification proofs. It does not contain an exploit or scanner for CVE-2024-53104; the vulnerability is discussed and a negative control is provided to demonstrate the bug class, but the primary artifact is a technical analysis and hardening demonstration.

Backdoor review

No backdoor observed in reviewed code

The repository is a research spike demonstrating a C-to-Rust rewrite of a Linux kernel UVC descriptor parser, with differential fuzzing and formal verification. All reviewed source code is consistent with this stated purpose. The C and Rust implementations parse untrusted USB descriptor data locally; no network communication, data exfiltration, or unrelated payload execution is present. The fuzzer harness drives both implementations and compares results, saving findings to a local directory. The negative control feature (SPIKE_VULN) is clearly documented and opt-in. No concealed or materially misrepresented harmful behavior was found.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesCRustPythonLean
Target softwareLinux kernel UVC video driver
Attack typesout-of-bounds write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a writeup because it is a substantive technical analysis of a vulnerability and a hardening technique, including source code for a C extraction, a Rust rewrite, a fuzzer, and formal verification. It does not contain code intended to exploit a live system (exploit) or to scan for the vulnerability (scanner). The negative control is for demonstration purposes within the research context, not a standalone exploit.

README.md:1-72c/uvc_parse.c:1-25rust/src/lib.rs:1-20

Requirements

  • The artifact is a research spike and does not exploit a vulnerability. It requires a build environment with clang, Rust, and Lean to compile and run the provided code.README.md:70-72

Observed behavior

  • The artifact provides a C extraction of the vulnerable kernel code, a safe Rust rewrite, a differential fuzzer to compare their outputs, and formal verification proofs. It includes a negative control (SPIKE_VULN) that reintroduces the CVE-2024-53104 bug class to demonstrate the safety difference between C and Rust.README.md:12-46c/uvc_parse.c:985-1002rust/src/lib.rs:682-696
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Local File Write
Payload withheldThe differential fuzzer saves discovered divergences and panics as local files for analysis, which is standard fuzzer behavior and not a backdoor.fuzz/src/main.rs:125-126fuzz/src/main.rs:175-186
Compile Time Feature
Payload withheldAn opt-in negative control that reintroduces a CVE-2024-53104-class bug for testing. It is clearly documented in README.md, c/uvc_parse.c, and rust/src/lib.rs, and is disabled by default.README.md:27-30c/uvc_parse.c:985-1002rust/src/lib.rs:682-696
Review boundaries

What the analysis did not establish

  • material evidence limitation
  • 4 binary files (fuzz corpus seeds and a finding) were not inspected; their metadata and small sizes (13-61 bytes) are consistent with fuzzer test inputs.
  • 24 unclassified files (e.g., Lean verification proofs, build scripts) were not provided for review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

Showing 12 of 15