CVE-2024-56571 in Linux
Tóm tắt
Bởi VulDB • 03/08/2026
Based on the kernel log snippet provided, here is an analysis of the crash and potential causes/solutions.
### **Summary** This is a **kernel panic/oops** occurring in the **USB Video Class (UVC)** driver (`uvcvideo`) during device probing/initialization. The specific failure happens when trying to create media pad links between sub-devices, likely due to an invalid pointer or state corruption in `media_create_pad_link`.
---
### **Key Details from Log** 1. **Crash Location**: - `uvc_mc_register_entities` → `__v4l2_device_register_subdev` → `media_create_pad_link` - The crash occurs inside `media_create_pad_link`, which is part of the Linux Media Framework used to connect video sub-devices (e.g., sensor, ISP, V4L2 device).
2. **Call Trace**: ``` ? media_create_pad_link+0x91/0x2e0 <-- Likely where the invalid operation occurred ? __v4l2_device_register_subdev+0x202/0x210 uvc_mc_register_entities+0x358/0x400 <-- UVC driver registering media entities uvc_register_chains+0x1fd/0x290 <-- Setting up video chains (e.g., sensor → decoder) uvc_probe+0x380e/0x3dc0 <-- USB probe function for the camera device ```
3. **Registers**: - `CR2: 0000592cc27635b0` → This is the **faulting address** (invalid memory access). The kernel tried to read/write this virtual address, which likely points to an uninitialized or freed pointer.
4. **Context**: - Happens during `uvc_probe`, meaning it occurs when a USB webcam/video device is plugged in and the driver tries to initialize it.
---
### **Likely Causes** 1. **Bug in UVC Driver or Media Framework**: A known issue where `media_create_pad_link` receives an invalid entity pointer (e.g., due to race conditions, missing initialization, or incorrect device tree/ACPI data).
2. **Incompatible USB Camera Device**: Some webcams have non-standard descriptors or firmware that confuse the UVC driver’s media graph setup.
3. **Kernel Bug in `media_create_pad_link`**: If one of the sub-devices (e.g., a sensor driver) fails to register properly, its entity pointer may be NULL or invalid when passed to `media_create_pad_link`.
4. **Hardware/USB Issue**: Corrupted USB descriptors or electrical issues causing incomplete device enumeration.
---
### **Troubleshooting Steps**
#### 1. **Check for Known Kernel Bugs** - Search your kernel version (e.g., via `uname -r`) and the error pattern: ```bash dmesg | grep "uvcvideo" journalctl -k | grep uvc ``` - Look for patches in newer kernels. This issue has been reported in older kernels (5.x–6.x) and may be fixed in recent versions.
#### 2. **Update Kernel** - If you’re on an older kernel, try updating to the latest stable release. Many UVC/media framework bugs are resolved upstream.
#### 3. **Disable Media Framework for This Device (Workaround)** If you don’t need advanced media graph features, you can force the UVC driver to use a simpler mode: - Add this boot parameter or module option: ```bash options uvcvideo nodrop=1 timeout=500 quirk=0x8087:0xab3d ``` *(Replace `0x8087:0xab3d` with your camera’s vendor/product ID, found via `lsusb`.)*
- Alternatively, disable media controller support for UVC (if compiled as a module): ```bash echo "options uvcvideo enable_media_controller=0" > /etc/modprobe.d/uvc.conf modprobe -r uvcvideo && modprobe uvcvideo ```
#### 4. **Check USB Device Descriptors** - Run `lsusb -v -d <vendor>:<product>` to inspect the camera’s descriptors. Look for malformed or missing fields that might confuse the driver.
#### 5. **Test with Another Camera/USB Port** - Rule out hardware issues by testing a different webcam or USB port.
#### 6. **Enable Debug Logging** - Increase UVC
If you want to get best quality of vulnerability data, you may have to visit VulDB.