CVE-2024-53104·Kernel vulnerability

Affected versions

How to fix this CVE

Update the Linux kernel to version 6.12.1 or later, which adds a check to skip frames of type UVC_VS_UNDEFINED during format parsing. If an immediate kernel update is not feasible, disable the uvcvideo kernel module to eliminate the attack surface entirely. Organizations should also enforce USB device policies to prevent unauthorized peripherals from being connected to servers.

# Check current kernel version
uname -r

# Update package lists and install latest kernel
sudo apt update && sudo apt upgrade -y linux-image-generic linux-headers-generic

# If running HWE kernel (common on Ubuntu LTS)
sudo apt install --install-recommends linux-generic-hwe-$(lsb_release -rs) -y

# Reboot to load the patched kernel
sudo reboot

# After reboot, verify the new kernel is loaded
uname -r

# Temporary mitigation: disable UVC driver without reboot
sudo modprobe -r uvcvideo
echo 'blacklist uvcvideo' | sudo tee /etc/modprobe.d/blacklist-uvcvideo.conf

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

This vulnerability is exploited through the USB physical access vector. An attacker must connect a malicious USB device (or compromise an existing USB peripheral) that presents itself as a UVC-compliant video device. The crafted device sends specially formed USB video streaming descriptors containing frames with type UVC_VS_UNDEFINED (value 0x00). During enumeration, the kernel's uvc_parse_streaming function calculates a buffer size that does not account for these undefined frame types, but uvc_parse_format then attempts to write data for them, causing a heap buffer overflow. This is a local privilege escalation path: an attacker with physical access to a USB port can achieve arbitrary kernel memory writes, leading to full root compromise. The attack has been observed in targeted surveillance operations where a seemingly innocuous USB device is connected to a target machine.

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

A Web Application Firewall cannot mitigate CVE-2024-53104. This vulnerability operates entirely within the Linux kernel's USB subsystem and does not involve any network traffic, HTTP requests, or web application layer interaction. The attack vector is physical access via USB, which is outside the scope of any network-based security control.

Recommended compensating controls:
- Enforce USB device authorization policies using USBGuard (usbguard daemon) to whitelist only known devices
- Disable the uvcvideo kernel module on servers that have no legitimate need for USB cameras
- Implement physical security controls to restrict USB port access on production servers
- Enable kernel lockdown mode (integrity or confidentiality) to limit kernel module loading
- Use grsecurity or SELinux policies to restrict device enumeration capabilities
- Monitor dmesg and kernel logs for unexpected USB device enumeration events

How to check if you are affected

1. { "step": 1, "title": "Check if the vulnerable kernel module is loaded", "command": "lsmod | grep uvcvideo", "description": "If the uvcvideo module is loaded, the system has an active attack surface for this CVE. Servers typically should not have this module loaded unless they use USB webcams." }
2. { "step": 2, "title": "Verify current kernel version against patched versions", "command": "uname -r", "description": "Compare the running kernel version against the fixed version 6.12.1+. Note that many distributions backport fixes, so also check your distro's security advisory for the specific package version that includes the patch." }
3. { "step": 3, "title": "Check installed kernel packages for patch status", "command": "apt list --installed 2>/dev/null | grep linux-image || rpm -qa | grep kernel-core", "description": "List installed kernel packages to determine whether a patched version has been installed. Cross-reference the package version with your distribution's CVE tracker for CVE-2024-53104." }
4. { "step": 4, "title": "Audit recent USB device connections in kernel logs", "command": "dmesg | grep -iE 'usb|uvc' | tail -30", "description": "Review kernel messages for any unexpected USB device enumeration events. Look for UVC devices that should not be present on a server, which could indicate an exploitation attempt." }
5. { "step": 5, "title": "Check systemd journal for USB events over the past week", "command": "journalctl -k --since '7 days ago' | grep -iE 'new (usb|high speed|full speed|low speed)' | tail -20", "description": "Search the persistent journal for USB device connection events that may have occurred outside the current boot's dmesg buffer. Unexpected USB enumerations on headless servers warrant investigation." }
6. { "step": 6, "title": "Verify USB device authorization policy", "command": "cat /sys/bus/usb/devices/usb*/authorized_default 2>/dev/null; systemctl is-active usbguard 2>/dev/null || echo 'USBGuard not installed'", "description": "Check whether USB device authorization is configured. A value of 1 for authorized_default means all USB devices are automatically authorized, increasing risk. USBGuard provides granular device-level control." }
7. { "step": 7, "title": "Scan for signs of kernel memory corruption", "command": "dmesg | grep -iE 'BUG|KASAN|slab-out-of-bounds|heap-buffer-overflow|general protection fault' | tail -20", "description": "Check kernel ring buffer for memory corruption indicators. KASAN reports or BUG entries related to slab/heap overflows near UVC code paths could indicate exploitation attempts." }

Indicators of compromise

• { "type": "kernel_log", "value": "uvcvideo: Found UVC format with unexpected frame type", "description": "Kernel log entry indicating the UVC driver encountered a frame with an undefined type during device enumeration" }
• { "type": "kernel_log", "value": "slab-out-of-bounds write in uvc_parse_format", "description": "KASAN detection of the heap overflow in the vulnerable function, indicating active exploitation" }
• { "type": "kernel_log", "value": "BUG: unable to handle page fault in uvc driver", "description": "Kernel page fault in UVC driver code paths, which may indicate memory corruption from exploitation" }
• { "type": "device_event", "value": "USB device with unexpected UVC streaming descriptor type 0x00", "description": "A USB device presenting UVC Video Streaming descriptors with frame type 0x00 (UVC_VS_UNDEFINED)" }
• { "type": "module_load", "value": "uvcvideo module loaded on headless server", "description": "The UVC video module being loaded on a server with no legitimate camera use is suspicious and warrants investigation" }

FAQ

Related Kernel CVEs

References

• https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4f
• https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29
• https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91d
• https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5
• https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204ae