CVE-2024-53061

media: s5p-jpeg: prevent buffer overflows

State: Published
Severity: 7.3 High
Published: Nov 19, 2024
Updated: Aug 5, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

media: s5p-jpeg: prevent buffer overflows

The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it.

While here, remove an unused word = 0 assignment.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H	Linux
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-191 Integer Underflow (Wrap or Wraparound)

Affected Products

Product	Versions
LinuxLinux	6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c5f6fefcda8fac8f082b6c5bf416567f4e100c51Affected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before e5117f6e7adcf9fd7546cdd0edc9abe4474bc98bAffected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before f54e8e1e39dacccebcfb9a9a36f0552a0a97e2efAffected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before a930cddfd153b5d4401df0c01effa14c831ff21eAffected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c85db2d4432de4ff9d97006691ce2dcb5bda660eAffected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before 784bc785a453eb2f8433dd62075befdfa1b2d6fdAffected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c951a0859fdacf49a2298b5551a7e52b95ff6f51Affected 6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before 14a22762c3daeac59a5a534e124acbb4d7a79b3aAffected
LinuxLinux	4.4Affected before 4.4Not affected 4.19.324 through 4.19.Not affected 5.4.286 through 5.4.Not affected 5.10.230 through 5.10.Not affected 5.15.172 through 5.15.Not affected 6.1.117 through 6.1.Not affected 6.6.61 through 6.6.Not affected 6.11.8 through 6.11.*Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c5f6fefcda8fac8f082b6c5bf416567f4e100c51Affected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before e5117f6e7adcf9fd7546cdd0edc9abe4474bc98bAffected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before f54e8e1e39dacccebcfb9a9a36f0552a0a97e2efAffected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before a930cddfd153b5d4401df0c01effa14c831ff21eAffected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c85db2d4432de4ff9d97006691ce2dcb5bda660eAffected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before 784bc785a453eb2f8433dd62075befdfa1b2d6fdAffected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before c951a0859fdacf49a2298b5551a7e52b95ff6f51Affected
6c96dbbc2aa9f5b4aed8792989d69eae22bf77c4 to before 14a22762c3daeac59a5a534e124acbb4d7a79b3aAffected

LinuxLinux

4.4Affected
before 4.4Not affected
4.19.324 through 4.19.*Not affected
5.4.286 through 5.4.*Not affected
5.10.230 through 5.10.*Not affected
5.15.172 through 5.15.*Not affected
6.1.117 through 6.1.*Not affected
6.6.61 through 6.6.*Not affected
6.11.8 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.