{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53063", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:24.975Z", "datePublished": "2024-11-19T17:22:33.518Z", "dateUpdated": "2026-08-05T11:43:25.149Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:25.149Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvbdev: prevent the risk of out of memory access\n\nThe dvbdev contains a static variable used to store dvb minors.\n\nThe behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set\nor not. When not set, dvb_register_device() won't check for\nboundaries, as it will rely that a previous call to\ndvb_register_adapter() would already be enforcing it.\n\nOn a similar way, dvb_device_open() uses the assumption\nthat the register functions already did the needed checks.\n\nThis can be fragile if some device ends using different\ncalls. This also generate warnings on static check analysers\nlike Coverity.\n\nSo, add explicit guards to prevent potential risk of OOM issues." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the `.open` handler of a character device; the array index is the minor number of a locally opened `/dev/dvb/...` inode. No network or adjacent-network input is involved, and no physical device access is needed beyond the node already existing.\nAC:L - The index is taken directly from the inode being opened — there is no race to win, no timing window, and no dependence on heap grooming or memory layout, so the out-of-bounds access is deterministic once the path is entered. Exploitation does not depend on any probabilistic condition.\nPR:L - `dvb_device_open()` performs no capability or permission check of its own; reaching it needs only the ability to open a DVB character device, which on set-top boxes, Android TV, media appliances, and desktop tuner systems is granted to ordinary users via the `video` group. No root or CAP_SYS_ADMIN is required by the code path itself.\nUI:N - The attacker triggers the path entirely on their own by issuing `open()` on the device node. No victim action, mount, or interaction with another user is required.\nS:U - The out-of-bounds access, the wild pointer dereference, and any resulting code execution all occur within the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - `dvb_minors[iminor(inode)]` is an unbounded read past the end of a static array, and the value read is used as a `struct dvb_device *` whose fields are dereferenced — the read is not limited to a few known bytes. Per kernel guidance an out-of-bounds read of this kind, usable to influence and observe kernel state, is High.\nI:H - The out-of-bounds-read pointer's `->fops` is fetched with `fops_get()`, installed into the file via `replace_fops()`, and then `file->f_op->open(inode, file)` is called — an indirect branch through a function-pointer table taken from memory outside the array bounds, which is a control-flow hijack primitive rather than a mere read fault.\nA:H - Dereferencing a garbage pointer read past the array, and calling through its `fops` table, faults on an unmapped or non-executable kernel address, producing an oops or panic. The condition is repeatable on every `open()` attempt." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/dvb-core/dvbdev.c" ], "versions": [ { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "fedfde9deb83ac8d2f3d5f36f111023df34b1684", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "3b88675e18b6517043a6f734eaa8ea6eb3bfa140", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "a4a17210c03ade1c8d9a9f193a105654b7a05c11", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "5f76f7df14861e3a560898fa41979ec92424b58f", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "b751a96025275c17f04083cbfe856822f1658946", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "1e461672616b726f29261ee81bb991528818537c", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "9c17085fabbde2041c893d29599800f2d4992b23", "status": "affected", "versionType": "git" }, { "version": "5dd3f3071070f5a306bdf8d474c80062f5691cba", "lessThan": "972e63e895abbe8aa1ccbdbb4e6362abda7cd457", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/dvb-core/dvbdev.c" ], "versions": [ { "version": "2.6.29", "status": "affected" }, { "version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.324", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.286", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.230", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.172", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.117", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.61", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.8", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "4.19.324" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.4.286" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.10.230" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "5.15.172" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.11.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/fedfde9deb83ac8d2f3d5f36f111023df34b1684" }, { "url": "https://git.kernel.org/stable/c/3b88675e18b6517043a6f734eaa8ea6eb3bfa140" }, { "url": "https://git.kernel.org/stable/c/a4a17210c03ade1c8d9a9f193a105654b7a05c11" }, { "url": "https://git.kernel.org/stable/c/5f76f7df14861e3a560898fa41979ec92424b58f" }, { "url": "https://git.kernel.org/stable/c/b751a96025275c17f04083cbfe856822f1658946" }, { "url": "https://git.kernel.org/stable/c/1e461672616b726f29261ee81bb991528818537c" }, { "url": "https://git.kernel.org/stable/c/9c17085fabbde2041c893d29599800f2d4992b23" }, { "url": "https://git.kernel.org/stable/c/972e63e895abbe8aa1ccbdbb4e6362abda7cd457" } ], "title": "media: dvbdev: prevent the risk of out of memory access", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53063", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:12:43.056905Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:17.286Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:28:57.818Z" } } ] } }