297 lines
15 KiB
JSON
297 lines
15 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2024-58034",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-02-27T02:16:34.052Z",
|
|
"datePublished": "2025-02-27T20:00:52.226Z",
|
|
"dateUpdated": "2026-08-05T11:47:28.781Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T11:47:28.781Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \"emc-tables\" node is always device's child\nnode with the property \"nvidia,use-ram-code\", and the \"lpddr2\" node is a\nchild of the \"emc-tables\" node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The vulnerable function is only reachable from `tegra_emc_probe()`, a platform-driver probe path on Tegra20 SoCs; there is no network, adjacent-network, or remote-peer data path to it, and any re-triggering requires local system access (sysfs driver bind/unbind or DT overlay load).\nAC:L - The unbalanced `of_node_put(dev->of_node)` performed by the first `of_find_node_by_name()` call executes deterministically on every affected board whose device tree carries `nvidia,use-ram-code`, with no race to win and no memory-layout precondition.\nPR:L - The code path runs automatically at probe with no authentication gate, and the guidance to prefer the higher severity where the required privilege is ambiguous makes Low the appropriate floor; the path is not remotely reachable, so None is not defensible.\nUI:N - The reference-count underflow occurs during driver probe without any victim action — no filesystem mount, file open, or other user operation is needed.\nS:U - The corrupted `device_node` objects and the affected driver both live in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The upstream fix describes the defect as \"resulting in possible UAFs\" of device-tree nodes; a use-after-free on a `device_node` gives an attacker-influenceable read of reallocated kernel heap contents, which per the guidance is scored High.\nI:H - The same use-after-free / double-put on live `device_node` structures allows a reclaimed object to be overwritten with attacker-controlled heap data, yielding a write primitive over kernel-resident pointers (`parent`, `child`, `properties`) usable for control-flow corruption.\nA:H - The bug drives OF refcounts to zero on nodes still in use, producing `of_node_release()` \"bad of_node_put()\" errors with `dump_stack()` and `refcount_t: underflow; use-after-free` warnings — a kernel oops/panic under `panic_on_warn`, and a crash outright in the UAF case."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/memory/tegra/tegra20-emc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "c3def10c610ae046aaa61d00528e7bd15e4ad8d3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "e9d07e91de140679eeaf275f47ad154467cb9e05",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "c144423cb07e4e227a8572d5742ca2b36ada770d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "3b02273446e23961d910b50cc12528faec649fb2",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "755e44538c190c31de9090d8e8821d228fcfd416",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "96e5da7c842424bcf64afe1082b960b42b96190b",
|
|
"lessThan": "b9784e5cde1f9fb83661a70e580e381ae1264d12",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/memory/tegra/tegra20-emc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.0",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.0",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.179",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.129",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.76",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.13",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.13.2",
|
|
"lessThanOrEqual": "6.13.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.14",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "5.15.179"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.1.129"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.6.76"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.12.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.13.2"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.0",
|
|
"versionEndExcluding": "6.14"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12"
|
|
}
|
|
],
|
|
"title": "memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"scope": "UNCHANGED",
|
|
"version": "3.1",
|
|
"baseScore": 7.8,
|
|
"attackVector": "LOCAL",
|
|
"baseSeverity": "HIGH",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"integrityImpact": "HIGH",
|
|
"userInteraction": "NONE",
|
|
"attackComplexity": "LOW",
|
|
"availabilityImpact": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"confidentialityImpact": "HIGH"
|
|
}
|
|
},
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2024-58034",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2025-03-04T17:59:56.831079Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"type": "CWE",
|
|
"cweId": "CWE-416",
|
|
"description": "CWE-416 Use After Free"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-03-04T18:07:17.095Z"
|
|
}
|
|
},
|
|
{
|
|
"title": "CVE Program Container",
|
|
"references": [
|
|
{
|
|
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
|
"shortName": "CVE",
|
|
"dateUpdated": "2025-11-03T19:33:40.926Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |