CVE-2024-58069

CVE-2024-58069 is a vulnerability in the Linux kernel's rtc-pcf85063 driver, specifically in the PCF85063 NVMEM read functionality. The issue arises from a mismatch between the nvmem interface, which supports variable buffer sizes, and the regmap interface, which expects a fixed-size unsigned int buffer. When an nvmem client provides a buffer smaller than 4 bytes, regmap_read performs an out-of-bounds write. This has been assigned CWE-787 (Out-of-bounds Write) and a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution, data corruption, or system crashes within the kernel context.

Mitigation involves applying the upstream kernel patches referenced in the stable repository commits, such as 21cd59fcb995, 3ab8c5ed4f84f, 517aedb365f2c, 6f2a8ca9a0a38, and 9adefa7b9559d. These patches fix the issue by using an intermediary unsigned int to safely hold the regmap_read value before copying it to the client's buffer, preventing the OOB write. Security practitioners should update affected Linux kernels to versions incorporating these fixes.