In the Linux kernel, the following vulnerability has been resolved:
memory: tegra20-emc: fix an OF node reference bug in tegraemcfindnodebyramcode()
As offindnodebyname() release the reference of the argument device node, tegraemcfindnodebyramcode() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the foreachchildofnode() macro and ofgetchildbyname() instead of offindnodebyname() to simplify the code.
This bug was found by an experimental verification tool that I am developing.
[krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@755e44538c190c31de9090d8e8821d228fcfd416",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-1e4d3d1f",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c144423cb07e4e227a8572d5742ca2b36ada770d",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-2dad1738",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9784e5cde1f9fb83661a70e580e381ae1264d12",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-2f359ddb",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9d07e91de140679eeaf275f47ad154467cb9e05",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-3273ba8e",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3def10c610ae046aaa61d00528e7bd15e4ad8d3",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-62dbe156",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3def10c610ae046aaa61d00528e7bd15e4ad8d3",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-6ca70775",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b9784e5cde1f9fb83661a70e580e381ae1264d12",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-77c8bcc2",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9d07e91de140679eeaf275f47ad154467cb9e05",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-81662e4e",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b02273446e23961d910b50cc12528faec649fb2",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-853779a0",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c144423cb07e4e227a8572d5742ca2b36ada770d",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-9b6a1803",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b02273446e23961d910b50cc12528faec649fb2",
"target": {
"function": "tegra_emc_find_node_by_ram_code",
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-9c8a589f",
"signature_type": "Function",
"digest": {
"length": 1583.0,
"function_hash": "8648728742997453209740507873668646170"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@755e44538c190c31de9090d8e8821d228fcfd416",
"target": {
"file": "drivers/memory/tegra/tegra20-emc.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2024-58034-a084ee25",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"47135525172003310166664295056726035213",
"45761421831647054082395476157023391464",
"14748813405923208893459685527263745541",
"314783477724045542181488017945671639196",
"95154812670584194426885844400542450417",
"202279051200593091212102313278245536155",
"108262221223774883666511991451297237782",
"158020131524161277641304245866668050105",
"102562298258704705877432731839782715125",
"336902006576033818786814518563412267339",
"249390976427173130342102756670118628262",
"143476286728030698810335407764645642348",
"204590842739267391418651477503056112138",
"144792663935800670345151643605288136467"
]
}
}
]