CVE-2024-38621

What it actually does

Reversed subtraction in unsigned bounds check combined with incorrect tracking of write position in stk1160_copy_video allows writing past buf->length when calculating destination offset from full lines and line parity.

Why it matters to the business

Kernel memory corruption on systems using stk1160 video capture hardware may cause crashes, data corruption, or attacker-controlled code execution; older unpatched kernels remain exposed despite low exploit likelihood.

How an attack unfolds

An attacker supplies crafted video frames to an stk1160 device; the driver performs video copy operations whose reversed length check always evaluates false, permitting writes beyond the allocated buffer at the computed line-and-offset destination.

How to fix it

Upgrade the Linux kernel to the commit f6a392266276730bea893b55d12940e32a25f56a or any later stable tree containing the corrected destination-offset bounds check before writing data.

How to confirm the fix worked

Inspect the stk1160 driver source for the patch that computes the actual write offset, compares it directly against buf->length, and returns early with an error when out of bounds.

Typical attack path

1. Attach or emulate an stk1160-compatible video source
2. Initiate video capture that invokes stk1160_copy_video
3. Supply frames that cause the destination offset to exceed buf->length
4. Leverage resulting memory corruption for privilege escalation or persistence

How to detect it

Review kernel logs for stk1160 error messages about out-of-bounds offsets, unexpected oops or panic traces during video copy, and any media device initialization anomalies around the time of suspected exploitation.

What your security team should do

• Apply the referenced kernel commit across all distributions using stk1160 hardware
• Disable the stk1160 driver module if the device is not required
• Include media subsystem buffer operations in kernel fuzzing and memory-safety testing