{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2024-58034",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2024-58034"
  ],
  "published": "2025-02-27T20:00:18Z",
  "summary": "memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()\n\nAs of_find_node_by_name() release the reference of the argument device\nnode, tegra_emc_find_node_by_ram_code() releases some device nodes while\nstill in use, resulting in possible UAFs. According to the bindings and\nthe in-tree DTS files, the \"emc-tables\" node is always device's child\nnode with the property \"nvidia,use-ram-code\", and the \"lpddr2\" node is a\nchild of the \"emc-tables\" node. Thus utilize the\nfor_each_child_of_node() macro and of_get_child_by_name() instead of\nof_find_node_by_name() to simplify the code.\n\nThis bug was found by an experimental verification tool that I am\ndeveloping.\n\n[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.129",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-58034"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:52:36Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The vulnerable function is only reachable from `tegra_emc_probe()`, a platform-driver probe path on Tegra20 SoCs; there is no network, adjacent-network, or remote-peer data path to it, and any re-triggering requires local system access (sysfs driver bind/unbind or DT overlay load).\nAC:L - The unbalanced `of_node_put(dev->of_node)` performed by the first `of_find_node_by_name()` call executes deterministically on every affected board whose device tree carries `nvidia,use-ram-code`, with no race to win and no memory-layout precondition.\nPR:L - The code path runs automatically at probe with no authentication gate, and the guidance to prefer the higher severity where the required privilege is ambiguous makes Low the appropriate floor; the path is not remotely reachable, so None is not defensible.\nUI:N - The reference-count underflow occurs during driver probe without any victim action \u2014 no filesystem mount, file open, or other user operation is needed.\nS:U - The corrupted `device_node` objects and the affected driver both live in the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The upstream fix describes the defect as \"resulting in possible UAFs\" of device-tree nodes; a use-after-free on a `device_node` gives an attacker-influenceable read of reallocated kernel heap contents, which per the guidance is scored High.\nI:H - The same use-after-free / double-put on live `device_node` structures allows a reclaimed object to be overwritten with attacker-controlled heap data, yielding a write primitive over kernel-resident pointers (`parent`, `child`, `properties`) usable for control-flow corruption.\nA:H - The bug drives OF refcounts to zero on nodes still in use, producing `of_node_release()` \"bad of_node_put()\" errors with `dump_stack()` and `refcount_t: underflow; use-after-free` warnings \u2014 a kernel oops/panic under `panic_on_warn`, and a crash outright in the UAF case."
    }
  }
}