CVE-2024-58034

memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()

High · published February 27, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()

As of_find_node_by_name() release the reference of the argument device

node, tegra_emc_find_node_by_ram_code() releases some device nodes while

still in use, resulting in possible UAFs. According to the bindings and

the in-tree DTS files, the "emc-tables" node is always device's child

node with the property "nvidia,use-ram-code", and the "lpddr2" node is a

child of the "emc-tables" node. Thus utilize the

for_each_child_of_node() macro and of_get_child_by_name() instead of

of_find_node_by_name() to simplify the code.

This bug was found by an experimental verification tool that I am

developing.

[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Published
2025-02-27T20:00Z
EPSS history
Timeline
  • 27 FEB 20:00Z
    memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
    cvelistv5