CVE-2024-58034

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58034
In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2 Patch
https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416 Patch
https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12 Patch
https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d Patch
https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3 Patch
https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Mar 2025, 18:31

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2 - () https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2 - Patch
References () https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416 - () https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416 - Patch
References () https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12 - () https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12 - Patch
References () https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d - () https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d - Patch
References () https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3 - () https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3 - Patch
References () https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 - () https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux

13 Mar 2025, 13:15

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3 -

04 Mar 2025, 18:15

Type Values Removed Values Added
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: memoria: tegra20-emc: se corrige un error de referencia de nodo OF en tegra_emc_find_node_by_ram_code() Como of_find_node_by_name() libera la referencia del nodo de dispositivo de argumento, tegra_emc_find_node_by_ram_code() libera algunos nodos de dispositivo mientras aún están en uso, lo que da como resultado posibles UAF. Según los enlaces y los archivos DTS en el árbol, el nodo "emc-tables" siempre es el nodo secundario del dispositivo con la propiedad "nvidia,use-ram-code", y el nodo "lpddr2" es un nodo secundario del nodo "emc-tables". Por lo tanto, utilice la macro for_each_child_of_node() y of_get_child_by_name() en lugar de of_find_node_by_name() para simplificar el código. Este error fue encontrado por una herramienta de verificación experimental que estoy desarrollando. [krzysztof: se aplicó la versión 1, se ajustó el mensaje de confirmación para incorporar partes de la versión 2]

27 Feb 2025, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 20:16

Updated : 2025-03-21 18:31

NVD link : CVE-2024-58034

Mitre link : CVE-2024-58034

CVE.ORG link : CVE-2024-58034

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free