CVE-2024-36895

What it actually does

The vulnerability stems from an incorrect buffer size check in __uvcg_iter_item_entries() after generalizing it to use a heap-allocated temporary buffer; the code still compares against sizeof() instead of the computed variable size, allowing writes beyond the 3-byte (32-bit) or 7-byte (64-bit) limit when parsing UVC configfs attribute lists such as dwFrameInterval.

Why it matters to the business

Systems using the UVC gadget driver on 32-bit Linux platforms may experience kernel crashes, memory corruption, or potential local privilege escalation when users configure USB video devices through configfs, impacting embedded, IoT, and legacy hardware deployments.

How an attack unfolds

An attacker with access to the configfs interface writes oversized string values (for example, six-digit frame interval entries) to UVC gadget attributes; the undersized stack/heap buffer then overflows during list parsing, allowing controlled memory corruption that can be leveraged for code execution or denial of service.

How to fix it

Update the Linux kernel to commit 7a54e5052bde582fd0e7677334fe7a5be92e242c or later stable releases that restore the correct size check against the computed buffer length; rebuild and deploy the fixed kernel on all affected 32-bit platforms.

How to confirm the fix worked

Confirm the running kernel contains commit 7a54e5052bde582fd0e7677334fe7a5be92e242c by checking /proc/version or the git log; test by writing a six-digit dwFrameInterval value through configfs and verify no overflow or crash occurs.

Typical attack path

1. Obtain write access to the UVC gadget configfs directory
2. Create or modify configfs attributes containing values longer than three characters on 32-bit systems
3. Trigger the list-parsing helper during gadget initialization or attribute store
4. Exploit the resulting buffer overflow to corrupt adjacent kernel memory
5. Escalate privileges or crash the system

How to detect it

Review kernel logs for buffer-overrun warnings or oops messages referencing uvc gadget configfs parsing; inspect audit logs for unusual writes to /sys/kernel/config/usb_gadget/*/configs/*/strings/* or similar UVC attribute paths.

What your security team should do

• Prioritize kernel upgrades on all 32-bit devices exposing UVC gadget functionality
• Restrict untrusted access to configfs mounts until patches are applied
• Monitor for kernel oops or panic logs related to uvcg_iter_item_entries
• Audit any downstream products that embed the vulnerable UVC gadget code