CVE-2024-58034
Published: 27 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
Security Summary
CVE-2024-58034 is a Use-After-Free (UAF) vulnerability in the Linux kernel's tegra20-emc driver, specifically within the tegra_emc_find_node_by_ram_code() function. The issue arises because of_find_node_by_name() releases the reference to the provided device node, leading the function to prematurely release nodes that are still in use. This affects systems using the Tegra20 External Memory Controller (EMC) component, which is tied to NVIDIA Tegra20 SoCs and relies on Device Tree (DT) bindings for "emc-tables" and child nodes like "lpddr2".
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, privilege escalation, or system crashes via the UAF.
The vulnerability has been addressed in multiple stable kernel releases through patches available in the Linux kernel git repository. These commits, such as 3b02273446e2, 755e44538c19, b9784e5cde1f, c144423cb07e, and c3def10c610a, simplify the node lookup by replacing of_find_node_by_name() with for_each_child_of_node() and of_get_child_by_name(), ensuring proper reference counting and preventing UAFs. Security practitioners should update to kernels incorporating these fixes.
Details
- CWE(s)