LiveActive security incident?Get immediate response
CVE Record

CVE-2024-53061: media: s5p-jpeg: prevent buffer overflows

In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in the Linux s5p-jpeg media driver can cause memory outside an intended buffer to be overwritten. A local, low-privileged user may be able to trigger it without user interaction, potentially affecting confidentiality, integrity, and availability. Exposure depends on whether an affected kernel and this driver are present and accessible.

Executive priority

Treat this as a high-priority local privilege-boundary risk on systems that expose the affected media driver. Patch confirmed-exposed systems promptly, but do not assume every Linux host is vulnerable. Asset and driver validation should precede emergency-wide action.

Technical view

The s5p-jpeg driver's existing calculations can allow the variable "word" to fall below 2, producing buffer overflows. Smatch identified the condition, and Linux stable fixes add bounds checks. The supplied CVSS 3.1 score is 7.8: local access, low complexity, low privileges, no user interaction, and potentially high confidentiality, integrity, and availability impact.

Likely exposure

Prioritize Linux systems running the affected releases identified by the CVE data, especially systems using the s5p-jpeg driver. The supplied version list is not expressed as clear ranges, so confirm exposure against the applicable kernel or distribution advisory and whether the driver is enabled and reachable.

Exploitation context

The CVSS vector describes a local, low-privilege attack requiring no user interaction. The supplied record does not establish remote exploitation, public exploit availability, or exploitation in the wild, and the CVE is not marked as present in CISA KEV.

Researcher notes

The source identifies an underflow-related bounds failure as CWE-191 and states that resulting buffer overflows are possible. It does not document a proof of concept, demonstrated code execution, or observed attacks. The duplicated introductory commit and non-range version list limit precise branch attribution; review the individual stable commits and distribution advisories.

Mitigation direction

  • Apply the corrected kernel package provided by the system's Linux distribution or hardware vendor.
  • For custom kernels, incorporate the applicable Linux stable fix and rebuild through established release processes.
  • If immediate updating is impossible, assess whether the s5p-jpeg driver can be safely disabled pending vendor guidance.
  • Restrict untrusted local access while affected systems await remediation.

Validation and detection

  • Record each system's kernel release, distribution package revision, architecture, and update source.
  • Determine whether the s5p-jpeg driver is configured, loaded, or available to local users.
  • Compare installed packages with the applicable vendor advisory and fixed package revision.
  • For custom kernels, verify that the relevant stable fix or an equivalent backport is present.
  • After updating, confirm the expected kernel is running and exposure inventory reflects the change.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-191: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-53061 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-53061Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4, 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4unaffected
LinuxLinux4.4, 0, 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, 6.12affected
Weakness

CWE details

CWE-191

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.