CVE-2024-47697

What it actually does

Off-by-one boundary check in rtl2830_pid_filter allows index==32 to reach set_bit/clear_bit on a 32-bit dev->filters value, producing an out-of-bounds write in kernel memory.

Why it matters to the business

Local memory corruption on systems using RTL2830-based DVB tuners can cause kernel crashes, data corruption, or potential privilege escalation; low exploitation likelihood and no KEV listing reduce immediate urgency despite 721 days of exposure.

How an attack unfolds

An attacker with local access loads or interacts with the rtl2830 DVB frontend driver and supplies a PID filter index of 32 or higher, bypassing the flawed check and writing beyond the filters bitmap; threat actors noted in broad 2024 zero-day and Linux kernel OOB campaigns could leverage similar patterns.

How to fix it

Apply the upstream fix that changes the check from index > 32 to index >= 32; upgrade the kernel to a version containing the resolution. Although listed fixes reference apache-airflow 2.7.0b1, the actual issue resides in the Linux kernel media subsystem.

How to confirm the fix worked

Confirm the corrected boundary check (index >= 32) exists in rtl2830_pid_filter; test with index values 31 and 32 to verify no out-of-bounds access occurs; review kernel changelog for the commit resolving the 33rd-bit write.

Typical attack path

1. Obtain local user access on a Linux system with the vulnerable rtl2830 driver loaded
2. Open or ioctl the DVB frontend device
3. Invoke pid_filter with index >= 32
4. Trigger set_bit/clear_bit on the out-of-bounds bit
5. Achieve kernel memory corruption for crash or escalation

How to detect it

Review kernel logs for rtl2830-related oops or BUG messages indicating bit operations beyond 31; inspect dmesg or syslog for media frontend errors around PID filter calls; correlate with process activity invoking DVB ioctls.

What your security team should do

• Prioritize kernel updates on any host exposing DVB/media devices
• Audit systems for presence of rtl2830 driver and restrict local access where possible
• Monitor EPSS and KEV updates for changes in exploitation probability
• Add the driver to allow-listing or disable if DVB functionality is unused