CVE-2024-58034

Summary

CVE-2024-58034 is a vulnerability affecting the Linux kernel's tegra20-emc driver. The issue arises due to a bug in the function tegra_emc_find_node_by_ram_code(), where the reference of a device node passed as an argument is released prematurely. Consequently, use-after-free (UAF) conditions can occur. Specifically, the "emc-tables" and "lpddr2" nodes, with the properties "nvidia,use-ram-code" and "nvidia,use-ram-code" respectively, are at risk. To mitigate this vulnerability, developers are advised to use the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name(). The vulnerability was discovered using an experimental verification tool developed by the reporter.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.