{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-58034", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:16:34.052Z", "datePublished": "2025-02-27T20:00:52.226Z", "dateUpdated": "2026-08-05T11:47:28.781Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:28.781Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \"emc-tables\" node is always device's child\nnode with the property \"nvidia,use-ram-code\", and the \"lpddr2\" node is a\nchild of the \"emc-tables\" node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable function is only reachable from `tegra_emc_probe()`, a platform-driver probe path on Tegra20 SoCs; there is no network, adjacent-network, or remote-peer data path to it, and any re-triggering requires local system access (sysfs driver bind/unbind or DT overlay load).\nAC:L - The unbalanced `of_node_put(dev->of_node)` performed by the first `of_find_node_by_name()` call executes deterministically on every affected board whose device tree carries `nvidia,use-ram-code`, with no race to win and no memory-layout precondition.\nPR:L - The code path runs automatically at probe with no authentication gate, and the guidance to prefer the higher severity where the required privilege is ambiguous makes Low the appropriate floor; the path is not remotely reachable, so None is not defensible.\nUI:N - The reference-count underflow occurs during driver probe without any victim action — no filesystem mount, file open, or other user operation is needed.\nS:U - The corrupted `device_node` objects and the affected driver both live in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The upstream fix describes the defect as \"resulting in possible UAFs\" of device-tree nodes; a use-after-free on a `device_node` gives an attacker-influenceable read of reallocated kernel heap contents, which per the guidance is scored High.\nI:H - The same use-after-free / double-put on live `device_node` structures allows a reclaimed object to be overwritten with attacker-controlled heap data, yielding a write primitive over kernel-resident pointers (`parent`, `child`, `properties`) usable for control-flow corruption.\nA:H - The bug drives OF refcounts to zero on nodes still in use, producing `of_node_release()` \"bad of_node_put()\" errors with `dump_stack()` and `refcount_t: underflow; use-after-free` warnings — a kernel oops/panic under `panic_on_warn`, and a crash outright in the UAF case." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/memory/tegra/tegra20-emc.c" ], "versions": [ { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "c3def10c610ae046aaa61d00528e7bd15e4ad8d3", "status": "affected", "versionType": "git" }, { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "e9d07e91de140679eeaf275f47ad154467cb9e05", "status": "affected", "versionType": "git" }, { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "c144423cb07e4e227a8572d5742ca2b36ada770d", "status": "affected", "versionType": "git" }, { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "3b02273446e23961d910b50cc12528faec649fb2", "status": "affected", "versionType": "git" }, { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "755e44538c190c31de9090d8e8821d228fcfd416", "status": "affected", "versionType": "git" }, { "version": "96e5da7c842424bcf64afe1082b960b42b96190b", "lessThan": "b9784e5cde1f9fb83661a70e580e381ae1264d12", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/memory/tegra/tegra20-emc.c" ], "versions": [ { "version": "5.0", "status": "affected" }, { "version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.179", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.129", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.76", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.13", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.2", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.179" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.129" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.13.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3" }, { "url": "https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05" }, { "url": "https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d" }, { "url": "https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2" }, { "url": "https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416" }, { "url": "https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12" } ], "title": "memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-58034", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-03-04T17:59:56.831079Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T18:07:17.095Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:33:40.926Z" } } ] } }