CVE-2024-53063

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
19/11/2024
Last modified:
03/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: dvbdev: prevent the risk of out of memory access<br /> <br /> The dvbdev contains a static variable used to store dvb minors.<br /> <br /> The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set<br /> or not. When not set, dvb_register_device() won&amp;#39;t check for<br /> boundaries, as it will rely that a previous call to<br /> dvb_register_adapter() would already be enforcing it.<br /> <br /> On a similar way, dvb_device_open() uses the assumption<br /> that the register functions already did the needed checks.<br /> <br /> This can be fragile if some device ends using different<br /> calls. This also generate warnings on static check analysers<br /> like Coverity.<br /> <br /> So, add explicit guards to prevent potential risk of OOM issues.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 2.6.29 (including) 4.19.324 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 4.20 (including) 5.4.286 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.5 (including) 5.10.230 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.11 (including) 5.15.172 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 5.16 (including) 6.1.117 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.2 (including) 6.6.61 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.11.8 (excluding)
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*