CVE-2024-58002

A dangling pointer vulnerability was found in the Linux kernel. When an async control is written, a copy of a pointer is made in the file handle that started the operation. If the user closes that file descriptor, its structure will be freed and there will be one dangling pointer per pending async control that the driver will try to use, leading to denial of service of the system.

A use after free problem was seen in uvc_ctrl_status_event in USB Video Class (UVC) driver. This flaw could allow a local normal user (which no special privilege) to crash the system at time of device closure. This vulnerability could even lead to a kernel information leak problem.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

In order to mitigate this issue it is possible to prevent the affected code from being loaded by blacklisting the kernel "USB Video Class module" (uvcvideo) module .

For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278uvcvideoz