CVE-2024-58034
Published: 27 February 2025
Summary
CVE-2024-58034 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 1.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-58034 is a Use-After-Free (UAF) vulnerability in the Linux kernel's tegra20-emc driver, specifically within the tegra_emc_find_node_by_ram_code() function. The issue arises because of_find_node_by_name() releases the reference to the provided device node, leading the function to prematurely release nodes that are still in use. This affects systems using the Tegra20 External Memory Controller (EMC) component, which is tied to NVIDIA Tegra20 SoCs and relies on Device Tree (DT) bindings for "emc-tables" and child nodes like "lpddr2".
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction required (UI:N), as indicated by its CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, privilege escalation, or system crashes via the UAF.
The vulnerability has been addressed in multiple stable kernel releases through patches available in the Linux kernel git repository. These commits, such as 3b02273446e2, 755e44538c19, b9784e5cde1f, c144423cb07e, and c3def10c610a, simplify the node lookup by replacing of_find_node_by_name() with for_each_child_of_node() and of_get_child_by_name(), ensuring proper reference counting and preventing UAFs. Security practitioners should update to kernels incorporating these fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5992
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting…
more
in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts]
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local UAF in kernel driver directly enables exploitation for privilege escalation to arbitrary code execution or system impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of flaws, directly addressing this UAF by applying kernel patches that fix improper Device Tree node reference counting in tegra_emc_find_node_by_ram_code().
RA-5 mandates vulnerability scanning and monitoring, enabling identification of systems running vulnerable Linux kernel versions affected by this Tegra20 EMC driver UAF.
SI-16 enforces memory protection mechanisms like KASLR and SMAP, which mitigate exploitation of the UAF even if the flawed kernel code is present.