GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50288 (GCVE-0-2024-50288)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:43
VLAI
Title
media: vivid: fix buffer overwrite when using > 32 buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers that can be requested was increased to 64 for the video capture queue. But video capture used a must_blank array that was still sized for 32 (VIDEO_MAX_FRAME). This caused an out-of-bounds write when using buffer indices >= 32. Create a new define MAX_VID_CAP_BUFFERS that is used to access the must_blank array and set max_num_buffers for the video capture queue. This solves a crash reported by: https://bugzilla.kernel.org/show_bug.cgi?id=219258
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:14 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cea70ed416b428f8214be196d62cc7ffaa11f1b8 , < e6bacd8f2178b22859fe6d9f755f19dfcd9d3862 (git)
Affected: cea70ed416b428f8214be196d62cc7ffaa11f1b8 , < 96d8569563916fe2f8fe17317e20e43f54f9ba4b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50288",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:27.609582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:21.514Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-core.c",
            "drivers/media/test-drivers/vivid/vivid-core.h",
            "drivers/media/test-drivers/vivid/vivid-ctrls.c",
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6bacd8f2178b22859fe6d9f755f19dfcd9d3862",
              "status": "affected",
              "version": "cea70ed416b428f8214be196d62cc7ffaa11f1b8",
              "versionType": "git"
            },
            {
              "lessThan": "96d8569563916fe2f8fe17317e20e43f54f9ba4b",
              "status": "affected",
              "version": "cea70ed416b428f8214be196d62cc7ffaa11f1b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/test-drivers/vivid/vivid-core.c",
            "drivers/media/test-drivers/vivid/vivid-core.h",
            "drivers/media/test-drivers/vivid/vivid-ctrls.c",
            "drivers/media/test-drivers/vivid/vivid-vid-cap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: fix buffer overwrite when using \u003e 32 buffers\n\nThe maximum number of buffers that can be requested was increased to\n64 for the video capture queue. But video capture used a must_blank\narray that was still sized for 32 (VIDEO_MAX_FRAME). This caused an\nout-of-bounds write when using buffer indices \u003e= 32.\n\nCreate a new define MAX_VID_CAP_BUFFERS that is used to access the\nmust_blank array and set max_num_buffers for the video capture queue.\n\nThis solves a crash reported by:\n\n\thttps://bugzilla.kernel.org/show_bug.cgi?id=219258"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through V4L2 ioctls (`VIDIOC_REQBUFS`/`VIDIOC_QBUF`/`VIDIOC_STREAMON`) on a local `/dev/videoN` character device exported by the vivid driver. There is no network-facing path to `vivid_fillbuff()`.\nAC:L - Exploitation is fully deterministic and attacker-controlled: request 64 buffers, queue a buffer whose index falls in the 36-43 range, and start streaming, and the capture kthread writes past `must_blank[32]` on the very first frame. No race must be won and no uncontrolled memory layout is involved \u2014 the corrupted offset within `struct vivid_dev` is chosen directly by the buffer index.\nPR:L - The attacker only needs to open the vivid video node, which requires no capability check whatsoever \u2014 on desktop, kiosk, CI and media-development systems the logged-in/local user gets access via the `video` group or the udev `uaccess` ACL. No CAP_SYS_ADMIN or root is needed for REQBUFS/QBUF/STREAMON.\nUI:N - The attacking process performs every step itself \u2014 open, allocate buffers, queue a high-index buffer, stream on. No victim action or cooperation is required.\nS:U - The out-of-bounds write stays within the kernel\u0027s own heap-allocated `struct vivid_dev` and its downstream effects remain inside the kernel security authority. This is a conventional in-kernel corruption, not a VM, IOMMU or sandbox boundary crossing.\nC:H - The OOB reads at `vivid-kthread-cap.c:220`/`:423` disclose adjacent struct bytes, and corrupting `fmt_cap` makes the driver interpret arbitrary kernel memory as a `vivid_fmt` descriptor, driving `data_offset`/`bit_depth`/`planes` values that cause kernel memory to be copied into the userspace-mmap\u0027d capture buffer. That yields a kernel memory disclosure primitive.\nI:H - An unprivileged user gets an out-of-bounds write at a chosen offset that corrupts the `fmt_cap` pointer, which is then dereferenced to supply the size argument to `memset(vbuf, ..., dev-\u003efmt_cap-\u003edata_offset[p])` and to compute plane geometry \u2014 turning a one-byte overflow into a large, uncontrolled kernel write suitable for heap grooming and control-flow hijacking.\nA:H - The reported real-world symptom is a kernel crash (bugzilla 219258): the zeroed `fmt_cap` pointer becomes non-canonical or misaligned and its dereference oopses the capture kthread, and the oversized `memset` overruns the video buffer. Any local user can trigger this repeatedly to panic the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:06.881Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6bacd8f2178b22859fe6d9f755f19dfcd9d3862"
        },
        {
          "url": "https://git.kernel.org/stable/c/96d8569563916fe2f8fe17317e20e43f54f9ba4b"
        }
      ],
      "title": "media: vivid: fix buffer overwrite when using \u003e 32 buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50288",
    "datePublished": "2024-11-19T01:30:32.682Z",
    "dateReserved": "2024-10-21T19:36:19.984Z",
    "dateUpdated": "2026-08-05T11:43:06.881Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50288",
      "date": "2026-09-16",
      "epss": "0.00203",
      "percentile": "0.10427"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.8\", \"versionEndExcluding\": \"6.11.8\", \"matchCriteriaId\": \"24AB354E-701F-4D6C-8B18-A0BBA5C21C30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: vivid: fix buffer overwrite when using \u003e 32 buffers\\n\\nThe maximum number of buffers that can be requested was increased to\\n64 for the video capture queue. But video capture used a must_blank\\narray that was still sized for 32 (VIDEO_MAX_FRAME). This caused an\\nout-of-bounds write when using buffer indices \u003e= 32.\\n\\nCreate a new define MAX_VID_CAP_BUFFERS that is used to access the\\nmust_blank array and set max_num_buffers for the video capture queue.\\n\\nThis solves a crash reported by:\\n\\n\\thttps://bugzilla.kernel.org/show_bug.cgi?id=219258\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: vivid: se corrige la sobrescritura de b\\u00fafer al usar \u0026gt; 32 b\\u00faferes. La cantidad m\\u00e1xima de b\\u00faferes que se pueden solicitar se aument\\u00f3 a 64 para la cola de captura de video. Pero la captura de video us\\u00f3 una matriz must_blank que todav\\u00eda ten\\u00eda un tama\\u00f1o de 32 (VIDEO_MAX_FRAME). Esto provoc\\u00f3 una escritura fuera de los l\\u00edmites cuando se usan \\u00edndices de b\\u00fafer \u0026gt;= 32. Cree una nueva definici\\u00f3n MAX_VID_CAP_BUFFERS que se use para acceder a la matriz must_blank y establezca max_num_buffers para la cola de captura de video. Esto resuelve un bloqueo informado por: https://bugzilla.kernel.org/show_bug.cgi?id=219258\"}]",
      "id": "CVE-2024-50288",
      "lastModified": "2024-11-27T15:32:45.147",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-19T02:16:31.023",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/96d8569563916fe2f8fe17317e20e43f54f9ba4b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e6bacd8f2178b22859fe6d9f755f19dfcd9d3862\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50288\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-19T02:16:31.023\",\"lastModified\":\"2026-08-04T11:21:42.027\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: vivid: fix buffer overwrite when using \u003e 32 buffers\\n\\nThe maximum number of buffers that can be requested was increased to\\n64 for the video capture queue. But video capture used a must_blank\\narray that was still sized for 32 (VIDEO_MAX_FRAME). This caused an\\nout-of-bounds write when using buffer indices \u003e= 32.\\n\\nCreate a new define MAX_VID_CAP_BUFFERS that is used to access the\\nmust_blank array and set max_num_buffers for the video capture queue.\\n\\nThis solves a crash reported by:\\n\\n\\thttps://bugzilla.kernel.org/show_bug.cgi?id=219258\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: vivid: se corrige la sobrescritura de b\u00fafer al usar \u0026gt; 32 b\u00faferes. La cantidad m\u00e1xima de b\u00faferes que se pueden solicitar se aument\u00f3 a 64 para la cola de captura de video. Pero la captura de video us\u00f3 una matriz must_blank que todav\u00eda ten\u00eda un tama\u00f1o de 32 (VIDEO_MAX_FRAME). Esto provoc\u00f3 una escritura fuera de los l\u00edmites cuando se usan \u00edndices de b\u00fafer \u0026gt;= 32. Cree una nueva definici\u00f3n MAX_VID_CAP_BUFFERS que se use para acceder a la matriz must_blank y establezca max_num_buffers para la cola de captura de video. Esto resuelve un bloqueo informado por: https://bugzilla.kernel.org/show_bug.cgi?id=219258\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/test-drivers/vivid/vivid-core.c\",\"drivers/media/test-drivers/vivid/vivid-core.h\",\"drivers/media/test-drivers/vivid/vivid-ctrls.c\",\"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cea70ed416b428f8214be196d62cc7ffaa11f1b8\",\"lessThan\":\"e6bacd8f2178b22859fe6d9f755f19dfcd9d3862\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cea70ed416b428f8214be196d62cc7ffaa11f1b8\",\"lessThan\":\"96d8569563916fe2f8fe17317e20e43f54f9ba4b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/test-drivers/vivid/vivid-core.c\",\"drivers/media/test-drivers/vivid/vivid-core.h\",\"drivers/media/test-drivers/vivid/vivid-ctrls.c\",\"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.8\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:14:27.609582Z\",\"id\":\"CVE-2024-50288\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.11.8\",\"matchCriteriaId\":\"24AB354E-701F-4D6C-8B18-A0BBA5C21C30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/96d8569563916fe2f8fe17317e20e43f54f9ba4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e6bacd8f2178b22859fe6d9f755f19dfcd9d3862\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:17:03+00:00",
      "cve": "CVE-2024-50288",
      "id": "CVE-2024-50288",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: vivid: fix buffer overwrite when using \u003e 32 buffers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50288.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-30T02:17:56Z",
      "cve": "CVE-2024-50288",
      "id": "CVE-2024-50288",
      "initial_release_date": "2024-11-19T03:49:07Z",
      "product_status:known_not_affected": "477",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50288",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50288.json",
      "version": "23"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50288\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:14:27.609582Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:27:07.576Z\"}}], \"cna\": {\"title\": \"media: vivid: fix buffer overwrite when using \u003e 32 buffers\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"cea70ed416b428f8214be196d62cc7ffaa11f1b8\", \"lessThan\": \"e6bacd8f2178b22859fe6d9f755f19dfcd9d3862\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"cea70ed416b428f8214be196d62cc7ffaa11f1b8\", \"lessThan\": \"96d8569563916fe2f8fe17317e20e43f54f9ba4b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/media/test-drivers/vivid/vivid-core.c\", \"drivers/media/test-drivers/vivid/vivid-core.h\", \"drivers/media/test-drivers/vivid/vivid-ctrls.c\", \"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.8\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.8\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/media/test-drivers/vivid/vivid-core.c\", \"drivers/media/test-drivers/vivid/vivid-core.h\", \"drivers/media/test-drivers/vivid/vivid-ctrls.c\", \"drivers/media/test-drivers/vivid/vivid-vid-cap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/e6bacd8f2178b22859fe6d9f755f19dfcd9d3862\"}, {\"url\": \"https://git.kernel.org/stable/c/96d8569563916fe2f8fe17317e20e43f54f9ba4b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: vivid: fix buffer overwrite when using \u003e 32 buffers\\n\\nThe maximum number of buffers that can be requested was increased to\\n64 for the video capture queue. But video capture used a must_blank\\narray that was still sized for 32 (VIDEO_MAX_FRAME). This caused an\\nout-of-bounds write when using buffer indices \u003e= 32.\\n\\nCreate a new define MAX_VID_CAP_BUFFERS that is used to access the\\nmust_blank array and set max_num_buffers for the video capture queue.\\n\\nThis solves a crash reported by:\\n\\n\\thttps://bugzilla.kernel.org/show_bug.cgi?id=219258\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"6.8\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.8\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:50:54.777Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50288\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:17:21.514Z\", \"dateReserved\": \"2024-10-21T19:36:19.984Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T01:30:32.682Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.