CVE-2024-50288

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-50288
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50288.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-50288
Downstream
Related
Published
2024-11-19T01:30:32Z
Modified
2025-10-15T03:34:43.819736Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
media: vivid: fix buffer overwrite when using > 32 buffers
Details

In the Linux kernel, the following vulnerability has been resolved:

media: vivid: fix buffer overwrite when using > 32 buffers

The maximum number of buffers that can be requested was increased to 64 for the video capture queue. But video capture used a mustblank array that was still sized for 32 (VIDEOMAX_FRAME). This caused an out-of-bounds write when using buffer indices >= 32.

Create a new define MAXVIDCAPBUFFERS that is used to access the mustblank array and set maxnumbuffers for the video capture queue.

This solves a crash reported by:

https://bugzilla.kernel.org/show_bug.cgi?id=219258
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cea70ed416b428f8214be196d62cc7ffaa11f1b8
Fixed
e6bacd8f2178b22859fe6d9f755f19dfcd9d3862
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
cea70ed416b428f8214be196d62cc7ffaa11f1b8
Fixed
96d8569563916fe2f8fe17317e20e43f54f9ba4b

Affected versions

v6.*

v6.10
v6.10-rc1
v6.10-rc2
v6.10-rc3
v6.10-rc4
v6.10-rc5
v6.10-rc6
v6.10-rc7
v6.11
v6.11-rc1
v6.11-rc2
v6.11-rc3
v6.11-rc4
v6.11-rc5
v6.11-rc6
v6.11-rc7
v6.11.1
v6.11.2
v6.11.3
v6.11.4
v6.11.5
v6.11.6
v6.11.7
v6.12-rc1
v6.7
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.9
v6.9-rc1
v6.9-rc2
v6.9-rc3
v6.9-rc4
v6.9-rc5
v6.9-rc6
v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-17b17016",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "110637603012845572473546374827697960507",
                "300089619105097980172668620476768963475",
                "339340464713037065110278362323740412379",
                "117959912246070603715576877579282419186"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-327a2947",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "function": "vivid_vid_cap_s_ctrl",
            "file": "drivers/media/test-drivers/vivid/vivid-ctrls.c"
        },
        "digest": {
            "function_hash": "266601714981826392351879472400798863322",
            "length": 7036.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-38b55c29",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "function": "vivid_create_queue",
            "file": "drivers/media/test-drivers/vivid/vivid-core.c"
        },
        "digest": {
            "function_hash": "123544687811314724357603814910317199604",
            "length": 1631.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-400a5101",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "function": "vid_cap_start_streaming",
            "file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
        },
        "digest": {
            "function_hash": "121396454760083658071221557369165072258",
            "length": 693.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-5fc57ec7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "function": "vivid_vid_cap_s_ctrl",
            "file": "drivers/media/test-drivers/vivid/vivid-ctrls.c"
        },
        "digest": {
            "function_hash": "266601714981826392351879472400798863322",
            "length": 7036.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-7676e88e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-ctrls.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "93372637180118438935230681119829311011",
                "168976991788274547765341260614267348065",
                "3267405178655541085588070025409292221",
                "127134662753445931335637114401651773914"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-86549709",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "110637603012845572473546374827697960507",
                "300089619105097980172668620476768963475",
                "339340464713037065110278362323740412379",
                "117959912246070603715576877579282419186"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-8c5af750",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-core.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288075376881840189580915087658829850005",
                "338357689624744780940156905758417107999",
                "10426507019268700588988291806137876386",
                "165228455571996568981878512771638918127"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-a0ae9cf2",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@96d8569563916fe2f8fe17317e20e43f54f9ba4b",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "231414829672239640553982839998646766001",
                "81940210460872548253455911059551736906",
                "151692223792343383932274033469101693931",
                "298850104077253261828884990194293292736",
                "147375725036978050555110380409451715581",
                "99042541175326786363022689434193009812",
                "281015275418194507832300015542613206419"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-a4364e40",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "function": "vivid_create_queue",
            "file": "drivers/media/test-drivers/vivid/vivid-core.c"
        },
        "digest": {
            "function_hash": "123544687811314724357603814910317199604",
            "length": 1631.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-a773a7a3",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-ctrls.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "93372637180118438935230681119829311011",
                "168976991788274547765341260614267348065",
                "3267405178655541085588070025409292221",
                "127134662753445931335637114401651773914"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-50288-c1ca9207",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "function": "vid_cap_start_streaming",
            "file": "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
        },
        "digest": {
            "function_hash": "121396454760083658071221557369165072258",
            "length": 693.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-dbfa1252",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-core.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "288075376881840189580915087658829850005",
                "338357689624744780940156905758417107999",
                "10426507019268700588988291806137876386",
                "165228455571996568981878512771638918127"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-50288-f283171b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
        "signature_version": "v1",
        "target": {
            "file": "drivers/media/test-drivers/vivid/vivid-core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "231414829672239640553982839998646766001",
                "81940210460872548253455911059551736906",
                "151692223792343383932274033469101693931",
                "298850104077253261828884990194293292736",
                "147375725036978050555110380409451715581",
                "99042541175326786363022689434193009812",
                "281015275418194507832300015542613206419"
            ]
        },
        "deprecated": false
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.11.8