CVE-2021-30002: 
Linux Kernel vulnerability analysis and mitigation

A memory leak vulnerability (CVE-2021-30002) was discovered in the Linux kernel before version 5.11.3, specifically affecting systems with webcam devices. The issue resides in the video_usercopy function within drivers/media/v4l2-core/v4l2-ioctl.c. The vulnerability was discovered by Arnd Bergmann and reported in early 2021 (Kernel Commit, NVD).

The vulnerability occurs when handling IOCTL commands with argument sizes larger than 128 bytes that also use array arguments. Due to improper memory management, two memory allocations were made but only the latter one was released. This happened because there was only a single local variable to hold such temporary allocations. The issue was introduced in commit d14e6d76ebf7 which added multi-planar ioctl handling code (Kernel Commit). The vulnerability has been assigned a CVSS v3.1 base score of 6.2 (Medium) (NVD).

The vulnerability allows a local attacker with access to video devices (by default, any member of the "video" group) to cause a denial of service condition through memory exhaustion (Debian Advisory).

The vulnerability requires local access and membership in the video group to exploit. It has been confirmed that the vulnerability can be triggered by unprivileged users who have access to webcam devices (NVD).

The vulnerability was fixed in Linux kernel version 5.11.3 by adding separate variables to hold the pointers to temporary allocations. The fix was also backported to various Linux distributions. For example, Debian backported the fix to version 4.9.272-1 for Debian 9 (Stretch) (Debian Advisory).