Executive brief
A vulnerability in the Linux kernel's USBTV driver can cause a system deadlock when a USB video grabber device is disconnected. This issue occurs because the driver attempts to acquire unnecessary locks during the device cleanup process. An exploit could lead to a local denial-of-service, causing the system to hang or become unresponsive.
Technical details
A deadlock vulnerability exists in the usbtv_video_free() function within the drivers/media/usb/usbtv/usbtv-video.c component of the Linux kernel. The root cause is the improper use of mutex locks (vb2q_lock and v4l2_lock) during the video resource freeing process, which are redundant and can lead to a circular wait condition. This is particularly triggered when a device is disconnected, regardless of whether it is actively streaming. An attacker with local access could potentially trigger this deadlock to cause a denial-of-service. The fix involves removing the unnecessary lock calls and the redundant usbtv_stop() call, as the device unregistration process handles these actions safely.
Affected products
- Linux Linux Kernel 3.11 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.8.2
Timeline
- 2024-03-02: other: Patch authored
- 2024-05-01: disclosed: CVE published
- 2024-10-31: other: CISA-ADP CVSS enrichment
References
- https://git.kernel.org/stable/c/3e7d82ebb86e94643bdb30b0b5b077ed27dce1c2
- https://git.kernel.org/stable/c/4ec4641df57cbdfdc51bb4959afcdbcf5003ddb9
- https://git.kernel.org/stable/c/65e6a2773d655172143cc0b927cdc89549842895
- https://git.kernel.org/stable/c/bdd82c47b22a8befd617b723098b2a41b77373c7
- https://git.kernel.org/stable/c/d5ed208d04acf06781d63d30f9fa991e8d609ebd
- https://git.kernel.org/stable/c/dea46e246ef0f98d89d59a4229157cd9ffb636bf
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html