CVE-2024-58084

firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()

Medium · published March 6, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
7.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()

Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq

completion variable initialization") introduced a write barrier in probe

function to store global '__scm' variable. We all known barriers are

paired (see memory-barriers.txt: "Note that write barriers should

normally be paired with read or address-dependency barriers"), therefore

accessing it from concurrent contexts requires read barrier. Previous

commit added such barrier in qcom_scm_is_available(), so let's use that

directly.

Lack of this read barrier can result in fetching stale '__scm' variable

value, NULL, and dereferencing it.

Note that barrier in qcom_scm_is_available() satisfies here the control

dependency.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00178 · 7.1th percentile
Published
2025-03-06T16:22Z
EPSS history
Timeline
  • 06 MAR 16:22Z
    firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
    cvelistv5