Security readout for executives and security teams
Plain-English summary
CVE-2024-27072 is a Linux kernel availability issue in the usbtv media driver. A local user with access to the affected system can trigger a deadlock related to USB TV device disconnect handling, potentially causing service disruption. It is not described as a data theft or remote compromise issue.
Executive priority
Treat this as a medium-priority reliability fix. It can disrupt affected Linux systems but is local-only in the provided scoring and has no cited active exploitation. Patch during normal kernel maintenance, faster where shared workstations, labs, or appliance-like systems expose USB access.
Technical view
The Linux usbtv driver could deadlock in usbtv_video_free() because lock calls and a usbtv_stop() call were unnecessary during device cleanup. Kernel stable fixes remove those calls. The CVSS vector is local, low-complexity, low-privilege, no user interaction, with high availability impact only.
Likely exposure
Exposure is most likely on Linux systems running affected kernels where the usbtv driver is present and reachable through local access or attached USB TV capture hardware. Internet-facing services are not the primary exposure path based on the provided CVSS vector.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. The report originated from syzkaller-linked kernel testing evidence. The described trigger involves local device disconnect behavior, especially around streaming state, not a remote network attack path.
Researcher notes
Focus validation on the media/usbtv driver lifecycle and disconnect cleanup path. The fix removes locking in usbtv_video_free() and relies on unregistering to call usbtv_stop(). Evidence is specific to availability impact; no confidentiality or integrity impact is stated.
Mitigation direction
- Apply vendor kernel updates that include the referenced Linux stable fixes.
- Follow Debian LTS advisories where Debian kernels are in scope.
- Review Siemens SSA-265688 for affected Siemens-managed products.
- If updates are delayed, check vendor guidance for supported mitigations.
- Prioritize systems where untrusted users can access USB devices.
Validation and detection
- Inventory Linux kernel versions against affected and fixed vendor advisories.
- Confirm whether the usbtv driver is present, loaded, or required.
- Check kernel changelogs for the referenced stable usbtv fix commits.
- Identify systems with local or physical USB access by untrusted users.
- Validate Debian and Siemens assets against their cited advisories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-27072 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4ec4641df57cbdfdc51bb4959afcdbcf5003ddb9CVE reference, Linux
- https://git.kernel.org/stable/c/d5ed208d04acf06781d63d30f9fa991e8d609ebdCVE reference, Linux
- https://git.kernel.org/stable/c/bdd82c47b22a8befd617b723098b2a41b77373c7CVE reference, Linux
- https://git.kernel.org/stable/c/dea46e246ef0f98d89d59a4229157cd9ffb636bfCVE reference, Linux
- https://git.kernel.org/stable/c/3e7d82ebb86e94643bdb30b0b5b077ed27dce1c2CVE reference, Linux
- https://git.kernel.org/stable/c/65e6a2773d655172143cc0b927cdc89549842895CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.