CVE-2024-58002
Published: 27 February 2025
Summary
CVE-2024-58002 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-7 (Least Functionality).
Deeper analysis
CVE-2024-58002 is a use-after-free vulnerability (CWE-416) in the Linux kernel's uvcvideo driver, which handles USB Video Class devices such as webcams. The issue arises during asynchronous control operations, where the driver copies a pointer to the file handle that initiated the operation. If the user closes the file descriptor before the operation completes, the structure is freed, leaving dangling pointers—one per pending async control—that the driver later attempts to use.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes on affected systems with USB video devices in use.
The vulnerability has been addressed in multiple stable kernel commits, including 117f7a2975baa4b7d702d3f4830d5a4ebd0c6d50, 221cd51efe4565501a3dbf04cc011b537dcce7fb, 2a29413ace64627e178fd422dd8a5d95219a2c0b, 438bda062b2c40ddd7df23b932e29ffe0a448cac, and 4dbaa738c583a0e947803c69e8996e88cf98d971. These patches clean up dangling pointers during file release() and introduce a counter to avoid performance penalties in common cases without async operations. Security practitioners should apply these updates to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5217
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the…
more
device is done. Which could be anytime in the future. If the user closes that file descriptor, its structure will be freed, and there will be one dangling pointer per pending async control, that the driver will try to use. Clean all the dangling pointers during release(). To avoid adding a performance penalty in the most common case (no async operation), a counter has been introduced with some logic to make sure that it is properly handled.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in kernel driver enables local low-priv arbitrary code execution, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the use-after-free vulnerability in the uvcvideo driver by requiring timely application of the specified Linux kernel patches that clean dangling pointers.
Prevents exploitation by configuring systems to disable or remove the non-essential uvcvideo driver and USB video class functionality when not required.
Identifies affected systems through vulnerability scanning of kernel versions susceptible to CVE-2024-58002, enabling targeted remediation.