CVE-2024-58007

Summary

CVE-2024-58007 is a vulnerability affecting the Linux kernel on MSM8916 devices. The issue stems from an out-of-bounds read in the socinfo subsystem. The serial number, which is exposed in sysfs, is constant across devices and does not change. However, the firmware on MSM8916 exposes SOCINFO_VERSION(0, 8), which lacks support for the serial_num field in the socinfo struct. A flawed check in the kernel code causes an out-of-bounds read of data following the socinfo struct in SMEM, revealing potentially sensitive information. The vulnerability is addressed by changing offsetof() to offsetofend() to take the size of the field into account.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.