CVE-2024-53063: media: dvbdev: prevent the risk of out of memory access
First published: Tue Nov 19 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set, dvb_register_device() won't check for boundaries, as it will rely that a previous call to dvb_register_adapter() would already be enforcing it. On a similar way, dvb_device_open() uses the assumption that the register functions already did the needed checks. This can be fragile if some device ends using different calls. This also generate warnings on static check analysers like Coverity. So, add explicit guards to prevent potential risk of OOM issues.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | >=2.6.29<4.19.324 | |
| Linux Kernel | >=4.20<5.4.286 | |
| Linux Kernel | >=5.5<5.10.230 | |
| Linux Kernel | >=5.11<5.15.172 | |
| Linux Kernel | >=5.16<6.1.117 | |
| Linux Kernel | >=6.2<6.6.61 | |
| Linux Kernel | >=6.7<6.11.8 | |
| Linux Kernel | =6.12-rc1 | |
| Linux Kernel | =6.12-rc2 | |
| Linux Kernel | =6.12-rc3 | |
| Linux Kernel | =6.12-rc4 | |
| Linux Kernel | =6.12-rc5 | |
| Linux Kernel | =6.12-rc6 | |
| debian/linux | <=5.10.223-1 | 5.10.234-1 6.1.129-1 6.1.133-1 6.12.22-1 |
| debian/linux-6.1 | 6.1.129-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/fedfde9deb83ac8d2f3d5f36f111023df34b1684
- https://git.kernel.org/stable/c/3b88675e18b6517043a6f734eaa8ea6eb3bfa140
- https://git.kernel.org/stable/c/a4a17210c03ade1c8d9a9f193a105654b7a05c11
- https://git.kernel.org/stable/c/5f76f7df14861e3a560898fa41979ec92424b58f
- https://git.kernel.org/stable/c/b751a96025275c17f04083cbfe856822f1658946
- https://git.kernel.org/stable/c/1e461672616b726f29261ee81bb991528818537c
- https://git.kernel.org/stable/c/9c17085fabbde2041c893d29599800f2d4992b23
- https://git.kernel.org/stable/c/972e63e895abbe8aa1ccbdbb4e6362abda7cd457
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53063
- https://nvd.nist.gov/vuln/detail/CVE-2024-53063
- https://launchpad.net/bugs/cve/CVE-2024-53063
- https://security-tracker.debian.org/tracker/CVE-2024-53063
- https://ubuntu.com/security/CVE-2024-53063
- https://git.kernel.org/linus/972e63e895abbe8aa1ccbdbb4e6362abda7cd457
Frequently Asked Questions
What is the severity of CVE-2024-53063?
CVE-2024-53063 has a severity rating that reflects potential risks of out-of-memory access in the Linux kernel.
How do I fix CVE-2024-53063?
To fix CVE-2024-53063, update your Linux kernel to a patched version that resolves this issue.
Which versions of the Linux kernel are affected by CVE-2024-53063?
CVE-2024-53063 affects various versions of the Linux kernel between 2.6.29 and 6.12-rc6.
What are the implications of CVE-2024-53063 for users?
Users of the affected Linux kernel versions may face risks associated with out-of-memory access vulnerabilities.
Was CVE-2024-53063 introduced in a specific version of the Linux kernel?
CVE-2024-53063 is related to the configuration of the dvbdev subsystem in multiple Linux kernel versions.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/severity
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- collector/launchpad-cve
- source/Launchpad
- agent/references
- agent/source
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- vendor/linux
- canonical/linux kernel
- version/linux kernel/2.6.29
- version/linux kernel/4.20
- version/linux kernel/5.5
- version/linux kernel/5.11
- version/linux kernel/5.16
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.12-rc1
- version/linux kernel/6.12-rc2
- version/linux kernel/6.12-rc3
- version/linux kernel/6.12-rc4
- version/linux kernel/6.12-rc5
- version/linux kernel/6.12-rc6
- package-manager/debian