CVE-2024-53068
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-53068
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53068.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-53068
- Downstream
- Related
- Published
- 2024-11-19T17:22:36Z
- Modified
- 2025-10-17T16:59:36.104984Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Fix slab-use-after-free in scmibus_notifier()
The scmidev->name is released prematurely in _scmidevicedestroy(), which causes slab-use-after-free when accessing scmidev->name in scmibusnotifier(). So move the release of scmidev->name to scmidevicerelease() to avoid slab-use-after-free.
| BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec | Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1 | | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1 | Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT) | Call trace: | dumpbacktrace+0x94/0x114 | showstack+0x18/0x24 | dumpstacklvl+0x48/0x60 | printreport+0xf4/0x5b0 | kasanreport+0xa4/0xec | _asanreportload1noabort+0x20/0x2c | strncmp+0xe4/0xec | scmibusnotifier+0x5c/0x54c | notifiercallchain+0xb4/0x31c | blockingnotifiercallchain+0x68/0x9c | busnotify+0x54/0x78 | devicedel+0x1bc/0x840 | deviceunregister+0x20/0xb4 | _scmidevicedestroy+0xac/0x280 | scmidevicedestroy+0x94/0xd0 | scmichansetup+0x524/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | _driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | _driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | _platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20 | | Allocated by task 1: | kasansavestack+0x2c/0x54 | kasansettrack+0x2c/0x40 | kasansaveallocinfo+0x24/0x34 | _kasankmalloc+0xa0/0xb8 | _kmallocnodetrackcaller+0x6c/0x104 | kstrdup+0x48/0x84 | kstrdupconst+0x34/0x40 | _scmidevicecreate.part.0+0x8c/0x408 | scmidevicecreate+0x104/0x370 | scmichansetup+0x2a0/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | _driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | _driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | _platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20 | | Freed by task 1: | kasansavestack+0x2c/0x54 | kasansettrack+0x2c/0x40 | kasansavefreeinfo+0x38/0x5c | _kasanslabfree+0xe8/0x164 | _kmemcachefree+0x11c/0x230 | kfree+0x70/0x130 | kfreeconst+0x20/0x40 | _scmidevicedestroy+0x70/0x280 | scmidevicedestroy+0x94/0xd0 | scmichansetup+0x524/0x750 | scmiprobe+0x7fc/0x1508 | platformprobe+0xc4/0x19c | reallyprobe+0x32c/0x99c | _driverprobedevice+0x15c/0x3c4 | driverprobedevice+0x5c/0x170 | _driverattach+0x1c8/0x440 | busforeachdev+0xf4/0x178 | driverattach+0x3c/0x58 | busadddriver+0x234/0x4d4 | driverregister+0xf4/0x3c0 | _platformdriverregister+0x60/0x88 | scmidriverinit+0xb0/0x104 | dooneinitcall+0xb4/0x664 | kernelinitfreeable+0x3c8/0x894 | kernelinit+0x24/0x1e8 | retfromfork+0x10/0x20
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedee7a9c9f67c59008b330deff2762bd8cf1407eecFixed15b17bbcea07d49c43d21aa700485cbd9f9d00d8
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedee7a9c9f67c59008b330deff2762bd8cf1407eecFixed1e1f523b185a8ccdcba625b31ff0312d052900e2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedee7a9c9f67c59008b330deff2762bd8cf1407eecFixed295416091e44806760ccf753aeafdafc0ae268f3
Affected versions
v5.*
v6.*
Database specific
vanir_signatures
[
{
"deprecated": false,
"digest": {
"length": 77.0,
"function_hash": "198116239689472689870110612360515563622"
},
"signature_type": "Function",
"id": "CVE-2024-53068-07d82e4e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1f523b185a8ccdcba625b31ff0312d052900e2",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "scmi_device_release"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 77.0,
"function_hash": "198116239689472689870110612360515563622"
},
"signature_type": "Function",
"id": "CVE-2024-53068-2e11f3b6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295416091e44806760ccf753aeafdafc0ae268f3",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "scmi_device_release"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 435.0,
"function_hash": "281240851583870935006675191389308055311"
},
"signature_type": "Function",
"id": "CVE-2024-53068-4a9d3d92",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1f523b185a8ccdcba625b31ff0312d052900e2",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_destroy"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288778281004527773590435322878653494831",
"207798885548820993243757706376114703487",
"270703457763913599684236167952285840678",
"147547573492060205391511749334583640274",
"155338983622822500621425617267737096791",
"183940841008189156055332606524634878245",
"311224450601545770453983349422286627394",
"150521929361245585246700383198025317683",
"12525323757850385963715035936623027854",
"53320965596916113360758342159943538984",
"34238650232553267729999852104580226414",
"314466805913910742320368825701202070710"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-53068-59995baf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1f523b185a8ccdcba625b31ff0312d052900e2",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 77.0,
"function_hash": "198116239689472689870110612360515563622"
},
"signature_type": "Function",
"id": "CVE-2024-53068-5cba584d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b17bbcea07d49c43d21aa700485cbd9f9d00d8",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "scmi_device_release"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 1310.0,
"function_hash": "81657477793234917624241821320545913088"
},
"signature_type": "Function",
"id": "CVE-2024-53068-7e5531eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e1f523b185a8ccdcba625b31ff0312d052900e2",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_create"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 1310.0,
"function_hash": "81657477793234917624241821320545913088"
},
"signature_type": "Function",
"id": "CVE-2024-53068-a89357ac",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295416091e44806760ccf753aeafdafc0ae268f3",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_create"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 435.0,
"function_hash": "281240851583870935006675191389308055311"
},
"signature_type": "Function",
"id": "CVE-2024-53068-abbb1ee6",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295416091e44806760ccf753aeafdafc0ae268f3",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_destroy"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288778281004527773590435322878653494831",
"207798885548820993243757706376114703487",
"270703457763913599684236167952285840678",
"147547573492060205391511749334583640274",
"155338983622822500621425617267737096791",
"183940841008189156055332606524634878245",
"311224450601545770453983349422286627394",
"150521929361245585246700383198025317683",
"12525323757850385963715035936623027854",
"53320965596916113360758342159943538984",
"34238650232553267729999852104580226414",
"314466805913910742320368825701202070710"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-53068-be1de178",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@295416091e44806760ccf753aeafdafc0ae268f3",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288778281004527773590435322878653494831",
"207798885548820993243757706376114703487",
"270703457763913599684236167952285840678",
"147547573492060205391511749334583640274",
"155338983622822500621425617267737096791",
"183940841008189156055332606524634878245",
"311224450601545770453983349422286627394",
"150521929361245585246700383198025317683",
"12525323757850385963715035936623027854",
"53320965596916113360758342159943538984",
"34238650232553267729999852104580226414",
"314466805913910742320368825701202070710"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2024-53068-e771f37b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b17bbcea07d49c43d21aa700485cbd9f9d00d8",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 435.0,
"function_hash": "281240851583870935006675191389308055311"
},
"signature_type": "Function",
"id": "CVE-2024-53068-ea5d5fc5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b17bbcea07d49c43d21aa700485cbd9f9d00d8",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_destroy"
},
"signature_version": "v1"
},
{
"deprecated": false,
"digest": {
"length": 1310.0,
"function_hash": "81657477793234917624241821320545913088"
},
"signature_type": "Function",
"id": "CVE-2024-53068-fda85e92",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15b17bbcea07d49c43d21aa700485cbd9f9d00d8",
"target": {
"file": "drivers/firmware/arm_scmi/bus.c",
"function": "__scmi_device_create"
},
"signature_version": "v1"
}
]