CVE-2024-57980 – This CVE describes a double-free vulnerability ... (How to Fix)

Q: What is the severity of CVE-2024-57980?

CVE-2024-57980 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's UVC video driver. If exploited, it could lead to memory corruption and potential kernel panic or privilege escalation. Systems using USB video devices with the affected kernel driver are vulnerable.

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's UVC video driver. If exploited, it could lead to memory corruption and potential kernel panic or privilege escalation. Systems using USB video devices with the affected kernel driver are vulnerable.

💻 Affected Systems

Products:

Linux kernel with UVC video driver

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using USB video devices with the UVC driver. The vulnerability triggers during device initialization/cleanup.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or privilege escalation allowing attackers to gain root access and execute arbitrary code.

🟠

Likely Case

System instability or crash when USB video devices are connected/disconnected, potentially causing denial of service.

🟢

If Mitigated

Minor system instability that may require reboot if triggered accidentally.

🌐 Internet-Facing: LOW - Requires physical or local USB device access to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Malicious USB devices or local users could potentially exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering the error path in uvc_status_init() function, which may require specific USB device conditions or malformed device descriptors.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing the fix commits (3ba8884a56a3eb97c22f0ce0e4dd410d4ca4c277 and others listed)

Vendor Advisory: https://git.kernel.org/stable/c/3ba8884a56a3eb97c22f0ce0e4dd410d4ca4c277

Restart Required: No

Instructions:

1. Update to a kernel version containing the fix commits. 2. For distributions: Apply vendor kernel updates. 3. For custom kernels: Apply the patch from git.kernel.org. 4. Rebuild and install the kernel if compiling from source.

🔧 Temporary Workarounds

Disable UVC driver

all

Prevent loading of the vulnerable UVC video driver

echo 'blacklist uvcvideo' >> /etc/modprobe.d/blacklist.conf
rmmod uvcvideo

Restrict USB device access

all

Prevent unauthorized USB video devices from being connected

usbguard generate-policy > /etc/usbguard/rules.conf
systemctl enable --now usbguard

🧯 If You Can't Patch

Implement strict USB device control policies to prevent unauthorized USB video devices
Monitor system logs for kernel panic or OOPS messages related to UVC driver

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if it contains the vulnerable code by examining the UVC driver source or checking if patches are applied

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check that 'git log --oneline drivers/media/usb/uvc/uvc_status.c' includes the fix commits

📡 Detection & Monitoring

Log Indicators:

Kernel OOPS messages
Kernel panic logs
dmesg output showing UVC driver errors or double-free warnings

Network Indicators:

None - this is a local driver vulnerability

SIEM Query:

source="kernel" AND ("uvcvideo" OR "double free" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2024-57980

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

EPSS Score: 0.04% exploit probability (12.3th percentile)

Published: February 27, 2025

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-57980, you might also want to check these: