CVE-2024-50056

What it actually does

Potential dereference of an ERR_PTR value returned by find_format_by_pix() in uvc_v4l2.c, leading to invalid pointer access during format enumeration and try-format operations in the UVC gadget driver.

Why it matters to the business

Kernel instability or crashes on systems exposing USB video gadget functionality, increasing operational risk for embedded Linux devices and requiring prioritized patching where UVC gadgets are used.

How an attack unfolds

An attacker with access to trigger UVC V4L2 ioctl operations on a vulnerable kernel can cause the driver to dereference an error pointer instead of a valid format descriptor, resulting in memory corruption.

How to fix it

Update the Linux kernel to commit 03fa71e97e9bb116993ec1d51b8a6fe776db0984 or later; apply the equivalent stable backports for affected series. For listed packages apply the exact fixed versions such as httpd 2.4.37-43 and mod_http2 1.15.7-3 where applicable.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or verify that smatch no longer reports ERR_PTR dereference warnings in uvc_v4l2.c; test UVC format enumeration paths after upgrade.

Typical attack path

1. Identify system exposing UVC gadget interface
2. Issue V4L2 enumeration or format ioctl calls that reach find_format_by_pix or related functions
3. Trigger error path returning ERR_PTR and subsequent dereference
4. Achieve kernel memory corruption or crash

How to detect it

Review kernel logs for oops or panic messages referencing uvc_v4l2.c functions around format lookup; examine audit trails for unusual V4L2 ioctl sequences on gadget devices.

What your security team should do

• Prioritize kernel updates on any system using the UVC gadget driver
• Audit for USB gadget configurations that enable UVC
• Monitor for kernel oops involving uvc_v4l2.c after applying fixes