CVE-2024-57985

CVE-2024-57985

High · published February 27, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: Cleanup global '__scm' on probe failures

If SCM driver fails the probe, it should not leave global '__scm'

variable assigned, because external users of this driver will assume the

probe finished successfully. For example TZMEM parts ('__scm->mempool')

are initialized later in the probe, but users of it (__scm_smc_call())

rely on the '__scm' variable.

This fixes theoretical NULL pointer exception, triggered via introducing

probe deferral in SCM driver with call trace:

qcom_tzmem_alloc+0x70/0x1ac (P)

qcom_tzmem_alloc+0x64/0x1ac (L)

qcom_scm_assign_mem+0x78/0x194

qcom_rmtfs_mem_probe+0x2d4/0x38c

platform_probe+0x68/0xc8

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Published
2025-02-27T07:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel≥ 6.11, < 6.12.136.12.13
linux/linux_kernel≥ 6.13, < 6.13.26.13.2
References (3)
EPSS history
Timeline
  • 27 FEB 02:07Z
    firmware: qcom: scm: Cleanup global '__scm' on probe failures
    cvelistv5