CVE-2024-58084

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-58084
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() Commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq completion variable initialization") introduced a write barrier in probe function to store global '__scm' variable. We all known barriers are paired (see memory-barriers.txt: "Note that write barriers should normally be paired with read or address-dependency barriers"), therefore accessing it from concurrent contexts requires read barrier. Previous commit added such barrier in qcom_scm_is_available(), so let's use that directly. Lack of this read barrier can result in fetching stale '__scm' variable value, NULL, and dereferencing it. Note that barrier in qcom_scm_is_available() satisfies here the control dependency.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/b628510397b5cafa1f5d3e848a28affd1c635302 Patch
https://git.kernel.org/stable/c/e03db7c1255ebabba5e1a447754faeb138de15a2 Patch
https://git.kernel.org/stable/c/fee921e3c641f64185abee83f9a6e65f0b380682 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

24 Mar 2025, 18:30

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/b628510397b5cafa1f5d3e848a28affd1c635302 - () https://git.kernel.org/stable/c/b628510397b5cafa1f5d3e848a28affd1c635302 - Patch
References () https://git.kernel.org/stable/c/e03db7c1255ebabba5e1a447754faeb138de15a2 - () https://git.kernel.org/stable/c/e03db7c1255ebabba5e1a447754faeb138de15a2 - Patch
References () https://git.kernel.org/stable/c/fee921e3c641f64185abee83f9a6e65f0b380682 - () https://git.kernel.org/stable/c/fee921e3c641f64185abee83f9a6e65f0b380682 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool() el commit 2e4955167ec5 ("firmware: qcom: scm: Fix __scm and waitq ending variable initialization") introdujo una barrera de escritura en la función de sondeo para almacenar la variable global '__scm'. Todos sabemos que las barreras están emparejadas (consulte memory-barriers.txt: "Note que las barreras de escritura normalmente deben emparejarse con barreras de lectura o de dependencia de dirección"), por lo tanto, acceder a ellas desde contextos concurrentes requiere una barrera de lectura. Una confirmación anterior agregó dicha barrera en qcom_scm_is_available(), así que usémosla directamente. La falta de esta barrera de lectura puede resultar en la obtención del valor de la variable '__scm' obsoleto, NULL, y su desreferenciación. Tenga en cuenta que la barrera en qcom_scm_is_available() satisface aquí la dependencia de control.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476

06 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-06 17:15

Updated : 2025-03-24 18:30

NVD link : CVE-2024-58084

Mitre link : CVE-2024-58084

CVE.ORG link : CVE-2024-58084

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference