Security readout for executives and security teams
Plain-English summary
CVE-2024-53104 is a Linux kernel bug in the USB video camera driver. A low-privileged local attacker could trigger memory corruption that may compromise confidentiality, integrity, and availability. CISA lists it in KEV, so treat it as exploited and prioritize remediation on affected Linux systems.
Executive priority
High priority. This is a kernel memory corruption flaw with full CIA impact and CISA KEV listing. Remediate affected Linux fleets quickly, especially endpoints and camera-enabled devices, while using vendor kernel packages rather than one-off changes.
Technical view
The uvcvideo driver did not account for UVC_VS_UNDEFINED frames when sizing the frames buffer in uvc_parse_streaming. uvc_parse_format could then parse those frames and cause out-of-bounds writes. The CVSS vector is local, low complexity, low privilege, no user interaction, with high CIA impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernels where the uvcvideo driver or USB video camera handling is present. Workstations, kiosks, and embedded devices with camera support deserve priority. Systems without this driver path may have lower practical exposure, but kernel package status should still be verified.
Exploitation context
CISA KEV status supports active exploitation. The provided sources do not describe public exploit details, attacker tradecraft, or whether exploitation requires a malicious device, local process, or specific camera state. The CVSS vector indicates local access with low privileges and no user interaction.
Researcher notes
Focus review on uvc_parse_streaming and uvc_parse_format handling of UVC_VS_UNDEFINED frame descriptors. The source evidence supports an out-of-bounds write, but does not establish exploit mechanics. Validate by kernel branch and distro backport, not only by upstream version strings.
Mitigation direction
- Update to a vendor kernel package containing the upstream stable fixes.
- Apply relevant Debian LTS kernel advisories where Debian kernels are in use.
- Prioritize internet-managed endpoints and devices with USB camera exposure.
- Restrict unnecessary local access and untrusted USB device use until patched.
- Check vendor guidance for platform-specific mitigations or backports.
Validation and detection
- Inventory Linux kernel versions across endpoints, servers, and embedded devices.
- Confirm whether affected systems load or package the uvcvideo driver.
- Verify installed kernel packages include one of the referenced stable fixes or vendor backports.
- Check CISA KEV tracking for mandated remediation timelines.
- Run regression testing for camera-dependent workloads after kernel updates.
Public sources used
- CVE Program
- CVE List V5
- CISA Known Exploited Vulnerabilities Catalog
- Linux stable commit 95edf13a48e7
- Linux stable commit 684022f81f12
- Linux stable commit faff5bbb2762
- Linux stable commit 467d84dc78c9
- Linux stable commit beced2cb09b5
- Linux stable commit 575a562f7a3e
- Linux stable commit 622ad10aae5f
- Debian LTS advisory January 2025
- Debian LTS advisory March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-53104 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2024-53104 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-02-05T00:00:00.000Z: CVE-2024-53104 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/95edf13a48e75dc2cc5b0bc57bf90d6948a22fe8CVE reference, Linux
- https://git.kernel.org/stable/c/684022f81f128338fe3587ec967459669a1204aeCVE reference, Linux
- https://git.kernel.org/stable/c/faff5bbb2762c44ec7426037b3000e77a11d6773CVE reference, Linux
- https://git.kernel.org/stable/c/467d84dc78c9abf6b217ada22b3fdba336262e29CVE reference, Linux
- https://git.kernel.org/stable/c/beced2cb09b58c1243733f374c560a55382003d6CVE reference, Linux
- https://git.kernel.org/stable/c/575a562f7a3ec2d54ff77ab6810e3fbceef2a91dCVE reference, Linux
- https://git.kernel.org/stable/c/622ad10aae5f5e03b7927ea95f7f32812f692bb5CVE reference, Linux
- https://git.kernel.org/stable/c/1ee9d9122801eb688783acd07791f2906b87cb4fCVE reference, Linux
- https://git.kernel.org/stable/c/ecf2b43018da9579842c774b7f35dbe11b5c38ddCVE reference, Linux
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-53104CVE reference, CISA-ADP · government-resource
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.