CVE-2024-56571
Vulnerability from cvelistv5
Published
2024-12-27 14:23
Modified
2024-12-27 14:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Require entities to have a non-zero unique ID Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero unique ID. ``` Each Unit and Terminal within the video function is assigned a unique identification number, the Unit ID (UID) or Terminal ID (TID), contained in the bUnitID or bTerminalID field of the descriptor. The value 0x00 is reserved for undefined ID, ``` So, deny allocating an entity with ID 0 or an ID that belongs to a unit that is already added to the list of entities. This also prevents some syzkaller reproducers from triggering warnings due to a chain of entities referring to themselves. In one particular case, an Output Unit is connected to an Input Unit, both with the same ID of 1. But when looking up for the source ID of the Output Unit, that same entity is found instead of the input entity, which leads to such warnings. In another case, a backward chain was considered finished as the source ID was 0. Later on, that entity was found, but its pads were not valid. Here is a sample stack trace for one of those cases. [ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 20.830206] usb 1-1: Using ep0 maxpacket: 8 [ 20.833501] usb 1-1: config 0 descriptor?? [ 21.038518] usb 1-1: string descriptor 0 read error: -71 [ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201) [ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized! [ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized! [ 21.042218] ------------[ cut here ]------------ [ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0 [ 21.043195] Modules linked in: [ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444 [ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 [ 21.044639] Workqueue: usb_hub_wq hub_event [ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0 [ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00 [ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246 [ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1 [ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290 [ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000 [ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003 [ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000 [ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0 [ 21.051136] PKRU: 55555554 [ 21.051331] Call Trace: [ 21.051480] <TASK> [ 21.051611] ? __warn+0xc4/0x210 [ 21.051861] ? media_create_pad_link+0x2c4/0x2e0 [ 21.052252] ? report_bug+0x11b/0x1a0 [ 21.052540] ? trace_hardirqs_on+0x31/0x40 [ 21.052901] ? handle_bug+0x3d/0x70 [ 21.053197] ? exc_invalid_op+0x1a/0x50 [ 21.053511] ? asm_exc_invalid_op+0x1a/0x20 [ 21.053924] ? media_create_pad_link+0x91/0x2e0 [ 21.054364] ? media_create_pad_link+0x2c4/0x2e0 [ 21.054834] ? media_create_pad_link+0x91/0x2e0 [ 21.055131] ? _raw_spin_unlock+0x1e/0x40 [ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210 [ 21.055837] uvc_mc_register_entities+0x358/0x400 [ 21.056144] uvc_register_chains+0x1fd/0x290 [ 21.056413] uvc_probe+0x380e/0x3dc0 [ 21.056676] ? __lock_acquire+0x5aa/0x26e0 [ 21.056946] ? find_held_lock+0x33/0xa0 [ 21.057196] ? kernfs_activate+0x70/0x80 [ 21.057533] ? usb_match_dy ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/19464d73225224dca31e2fd6e7d6418facf5facb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4f74bd307f078c0605b9f6f1edb8337dee35fa2e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/72ed66623953106d15825513c82533a03ba29ecd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b11813bc2f4eee92695075148c9ba996f54feeba
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bde4e7c1527151b596089b3f984818ab537eeb7f
Impacted products
Vendor Product Version
Linux Linux Version: 5.7
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/uvc/uvc_driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bde4e7c1527151b596089b3f984818ab537eeb7f",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            },
            {
              "lessThan": "72ed66623953106d15825513c82533a03ba29ecd",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            },
            {
              "lessThan": "19464d73225224dca31e2fd6e7d6418facf5facb",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            },
            {
              "lessThan": "b11813bc2f4eee92695075148c9ba996f54feeba",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            },
            {
              "lessThan": "4f74bd307f078c0605b9f6f1edb8337dee35fa2e",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            },
            {
              "lessThan": "3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195",
              "status": "affected",
              "version": "a3fbc2e6bb05a3b1ea341cd29dea09b4a033727b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/uvc/uvc_driver.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: uvcvideo: Require entities to have a non-zero unique ID\n\nPer UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero\nunique ID.\n\n```\nEach Unit and Terminal within the video function is assigned a unique\nidentification number, the Unit ID (UID) or Terminal ID (TID), contained in\nthe bUnitID or bTerminalID field of the descriptor. The value 0x00 is\nreserved for undefined ID,\n```\n\nSo, deny allocating an entity with ID 0 or an ID that belongs to a unit\nthat is already added to the list of entities.\n\nThis also prevents some syzkaller reproducers from triggering warnings due\nto a chain of entities referring to themselves. In one particular case, an\nOutput Unit is connected to an Input Unit, both with the same ID of 1. But\nwhen looking up for the source ID of the Output Unit, that same entity is\nfound instead of the input entity, which leads to such warnings.\n\nIn another case, a backward chain was considered finished as the source ID\nwas 0. Later on, that entity was found, but its pads were not valid.\n\nHere is a sample stack trace for one of those cases.\n\n[   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd\n[   20.830206] usb 1-1: Using ep0 maxpacket: 8\n[   20.833501] usb 1-1: config 0 descriptor??\n[   21.038518] usb 1-1: string descriptor 0 read error: -71\n[   21.038893] usb 1-1: Found UVC 0.00 device \u003cunnamed\u003e (2833:0201)\n[   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!\n[   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!\n[   21.042218] ------------[ cut here ]------------\n[   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0\n[   21.043195] Modules linked in:\n[   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444\n[   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n[   21.044639] Workqueue: usb_hub_wq hub_event\n[   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0\n[   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 \u003c0f\u003e 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00\n[   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246\n[   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1\n[   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290\n[   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000\n[   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003\n[   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000\n[   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000\n[   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0\n[   21.051136] PKRU: 55555554\n[   21.051331] Call Trace:\n[   21.051480]  \u003cTASK\u003e\n[   21.051611]  ? __warn+0xc4/0x210\n[   21.051861]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.052252]  ? report_bug+0x11b/0x1a0\n[   21.052540]  ? trace_hardirqs_on+0x31/0x40\n[   21.052901]  ? handle_bug+0x3d/0x70\n[   21.053197]  ? exc_invalid_op+0x1a/0x50\n[   21.053511]  ? asm_exc_invalid_op+0x1a/0x20\n[   21.053924]  ? media_create_pad_link+0x91/0x2e0\n[   21.054364]  ? media_create_pad_link+0x2c4/0x2e0\n[   21.054834]  ? media_create_pad_link+0x91/0x2e0\n[   21.055131]  ? _raw_spin_unlock+0x1e/0x40\n[   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210\n[   21.055837]  uvc_mc_register_entities+0x358/0x400\n[   21.056144]  uvc_register_chains+0x1fd/0x290\n[   21.056413]  uvc_probe+0x380e/0x3dc0\n[   21.056676]  ? __lock_acquire+0x5aa/0x26e0\n[   21.056946]  ? find_held_lock+0x33/0xa0\n[   21.057196]  ? kernfs_activate+0x70/0x80\n[   21.057533]  ? usb_match_dy\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-27T14:23:14.200Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bde4e7c1527151b596089b3f984818ab537eeb7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/72ed66623953106d15825513c82533a03ba29ecd"
        },
        {
          "url": "https://git.kernel.org/stable/c/19464d73225224dca31e2fd6e7d6418facf5facb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b11813bc2f4eee92695075148c9ba996f54feeba"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f74bd307f078c0605b9f6f1edb8337dee35fa2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195"
        }
      ],
      "title": "media: uvcvideo: Require entities to have a non-zero unique ID",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56571",
    "datePublished": "2024-12-27T14:23:14.200Z",
    "dateReserved": "2024-12-27T14:03:05.997Z",
    "dateUpdated": "2024-12-27T14:23:14.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56571\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:16.077\",\"lastModified\":\"2024-12-27T15:15:16.077\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: uvcvideo: Require entities to have a non-zero unique ID\\n\\nPer UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero\\nunique ID.\\n\\n```\\nEach Unit and Terminal within the video function is assigned a unique\\nidentification number, the Unit ID (UID) or Terminal ID (TID), contained in\\nthe bUnitID or bTerminalID field of the descriptor. The value 0x00 is\\nreserved for undefined ID,\\n```\\n\\nSo, deny allocating an entity with ID 0 or an ID that belongs to a unit\\nthat is already added to the list of entities.\\n\\nThis also prevents some syzkaller reproducers from triggering warnings due\\nto a chain of entities referring to themselves. In one particular case, an\\nOutput Unit is connected to an Input Unit, both with the same ID of 1. But\\nwhen looking up for the source ID of the Output Unit, that same entity is\\nfound instead of the input entity, which leads to such warnings.\\n\\nIn another case, a backward chain was considered finished as the source ID\\nwas 0. Later on, that entity was found, but its pads were not valid.\\n\\nHere is a sample stack trace for one of those cases.\\n\\n[   20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd\\n[   20.830206] usb 1-1: Using ep0 maxpacket: 8\\n[   20.833501] usb 1-1: config 0 descriptor??\\n[   21.038518] usb 1-1: string descriptor 0 read error: -71\\n[   21.038893] usb 1-1: Found UVC 0.00 device \u003cunnamed\u003e (2833:0201)\\n[   21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!\\n[   21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!\\n[   21.042218] ------------[ cut here ]------------\\n[   21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0\\n[   21.043195] Modules linked in:\\n[   21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444\\n[   21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\\n[   21.044639] Workqueue: usb_hub_wq hub_event\\n[   21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0\\n[   21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 \u003c0f\u003e 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00\\n[   21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246\\n[   21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1\\n[   21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290\\n[   21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000\\n[   21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003\\n[   21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000\\n[   21.049648] FS:  0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000\\n[   21.050271] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[   21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0\\n[   21.051136] PKRU: 55555554\\n[   21.051331] Call Trace:\\n[   21.051480]  \u003cTASK\u003e\\n[   21.051611]  ? __warn+0xc4/0x210\\n[   21.051861]  ? media_create_pad_link+0x2c4/0x2e0\\n[   21.052252]  ? report_bug+0x11b/0x1a0\\n[   21.052540]  ? trace_hardirqs_on+0x31/0x40\\n[   21.052901]  ? handle_bug+0x3d/0x70\\n[   21.053197]  ? exc_invalid_op+0x1a/0x50\\n[   21.053511]  ? asm_exc_invalid_op+0x1a/0x20\\n[   21.053924]  ? media_create_pad_link+0x91/0x2e0\\n[   21.054364]  ? media_create_pad_link+0x2c4/0x2e0\\n[   21.054834]  ? media_create_pad_link+0x91/0x2e0\\n[   21.055131]  ? _raw_spin_unlock+0x1e/0x40\\n[   21.055441]  ? __v4l2_device_register_subdev+0x202/0x210\\n[   21.055837]  uvc_mc_register_entities+0x358/0x400\\n[   21.056144]  uvc_register_chains+0x1fd/0x290\\n[   21.056413]  uvc_probe+0x380e/0x3dc0\\n[   21.056676]  ? __lock_acquire+0x5aa/0x26e0\\n[   21.056946]  ? find_held_lock+0x33/0xa0\\n[   21.057196]  ? kernfs_activate+0x70/0x80\\n[   21.057533]  ? usb_match_dy\\n---truncated---\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19464d73225224dca31e2fd6e7d6418facf5facb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4f74bd307f078c0605b9f6f1edb8337dee35fa2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/72ed66623953106d15825513c82533a03ba29ecd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b11813bc2f4eee92695075148c9ba996f54feeba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bde4e7c1527151b596089b3f984818ab537eeb7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.