CVE-2024-58084
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-58084
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58084.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-58084
- Downstream
- Related
- Published
- 2025-03-06T16:22:31.998Z
- Modified
- 2025-11-20T07:36:37.329791Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: scm: Fix missing read barrier in qcomscmgettzmempool()
Commit 2e4955167ec5 ("firmware: qcom: scm: Fix scm and waitq completion variable initialization") introduced a write barrier in probe function to store global 'scm' variable. We all known barriers are paired (see memory-barriers.txt: "Note that write barriers should normally be paired with read or address-dependency barriers"), therefore accessing it from concurrent contexts requires read barrier. Previous commit added such barrier in qcomscmis_available(), so let's use that directly.
Lack of this read barrier can result in fetching stale '__scm' variable value, NULL, and dereferencing it.
Note that barrier in qcomscmis_available() satisfies here the control dependency.
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced449d0d84bcd8246b508d07995326d13c54488b8cFixedfee921e3c641f64185abee83f9a6e65f0b380682
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced449d0d84bcd8246b508d07995326d13c54488b8cFixede03db7c1255ebabba5e1a447754faeb138de15a2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced449d0d84bcd8246b508d07995326d13c54488b8cFixedb628510397b5cafa1f5d3e848a28affd1c635302
Affected versions
v6.*
Database specific
vanir_signatures
[
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"99798160995735435676925822496899627314",
"266874259436902835707797954464850917509",
"265918977058394233582490284325569257629",
"51897368441978369153750681652505734407"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fee921e3c641f64185abee83f9a6e65f0b380682",
"target": {
"file": "drivers/firmware/qcom/qcom_scm.c"
},
"id": "CVE-2024-58084-2e05db54"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 71.0,
"function_hash": "102326229931710336391490350162488535407"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fee921e3c641f64185abee83f9a6e65f0b380682",
"target": {
"file": "drivers/firmware/qcom/qcom_scm.c",
"function": "qcom_scm_get_tzmem_pool"
},
"id": "CVE-2024-58084-642f4026"
}
]