CVE-2024-58003

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58003", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-27T02:10:48.226Z", "datePublished": "2025-02-27T02:12:00.834Z", "dateUpdated": "2026-08-05T11:47:21.273Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:47:21.273Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ds90ub9x3: Fix extra fwnode_handle_put()\n\nThe ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as\npart of their remove process, and if the driver is removed multiple\ntimes, eventually leads to put \"overflow\", possibly causing memory\ncorruption or crash.\n\nThe fwnode_handle_put() is a leftover from commit 905f88ccebb1 (\"media:\ni2c: ds90ub9x3: Fix sub-device matching\"), which changed the code\nrelated to the sd.fwnode, but missed removing these fwnode_handle_put()\ncalls."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable teardown path is reached only through local driver lifecycle operations \u2014 sysfs bind/unbind of the ds90ub913a/ds90ub953 i2c driver or module unload/reload. There is no network, adjacent-network, or physical-hotplug path to the FPD-Link serializer i2c device, which is statically instantiated by the ds90ub960 deserializer at its probe.\nAC:L - Each unbind/rebind cycle deterministically drops exactly one unowned reference on the serializer fwnode, so the attacker simply repeats the cycle 3-4 times until the refcount underflows; no race, timing window, or uncontrollable memory-layout condition is involved. Heap grooming of the freed device_node is likewise under attacker control between cycles.\nPR:L - Consistent with this repo's treatment of driver unbind/module-reload lifetime bugs, an unprivileged local user with access to the driver model is scored as low privileges rather than full administrative privilege. The attacker needs no capability specific to the media subsystem and no authentication beyond local account access.\nUI:N - The attacker performs the repeated unbind/bind operations themselves; no victim action, filesystem mount, or file open is required. The refcount underflow accumulates purely from attacker-initiated driver removals.\nS:U - The underflowed fwnode and the resulting use-after-free are both within the kernel's own security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel memory-safety issue affecting the same security scope.\nC:H - The premature free of the device_node/fwnode leaves stale pointers in the i2c client device and in ds90ub960's rxport->ser.fwnode, so subsequent fwnode property reads operate on reallocated attacker-groomed heap memory, enabling disclosure of arbitrary kernel data. Reference-count underflow leading to use-after-free is scored High per kernel guidance.\nI:H - struct fwnode_handle carries a const struct fwnode_operations *ops that every fwnode_call_*_op macro invokes indirectly, so a freed-and-resprayed node hands the attacker a controlled indirect-call primitive and thus control-flow hijacking. The commit message itself warns of \"memory corruption.\"\nA:H - Even on static device trees where the node is not actually freed, of_node_release() emits an error plus dump_stack() and the following put produces a \"refcount_t: underflow; use-after-free\" kobject WARN \u2014 an oops, and a full panic under panic_on_warn. On dynamic/overlay nodes the use-after-free crashes the kernel outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/i2c/ds90ub913.c", "drivers/media/i2c/ds90ub953.c"], "versions": [{"version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "lessThan": "474d7baf91d37bc411fa60de5bbf03c9dd82e18a", "status": "affected", "versionType": "git"}, {"version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "lessThan": "f4e4373322f8d4c19721831f7fb989e52d30dab0", "status": "affected", "versionType": "git"}, {"version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "lessThan": "70743d6a8b256225675711e7983825f1be86062d", "status": "affected", "versionType": "git"}, {"version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "lessThan": "60b45ece41c5632a3a3274115a401cb244180646", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/media/i2c/ds90ub913.c", "drivers/media/i2c/ds90ub953.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.78", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.14", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.3", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.78"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.13.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/474d7baf91d37bc411fa60de5bbf03c9dd82e18a"}, {"url": "https://git.kernel.org/stable/c/f4e4373322f8d4c19721831f7fb989e52d30dab0"}, {"url": "https://git.kernel.org/stable/c/70743d6a8b256225675711e7983825f1be86062d"}, {"url": "https://git.kernel.org/stable/c/60b45ece41c5632a3a3274115a401cb244180646"}], "title": "media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/media/i2c/ds90ub913.c", "drivers/media/i2c/ds90ub953.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "474d7baf91d37bc411fa60de5bbf03c9dd82e18a", "status": "affected", "version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "versionType": "git"}, {"lessThan": "f4e4373322f8d4c19721831f7fb989e52d30dab0", "status": "affected", "version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "versionType": "git"}, {"lessThan": "70743d6a8b256225675711e7983825f1be86062d", "status": "affected", "version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "versionType": "git"}, {"lessThan": "60b45ece41c5632a3a3274115a401cb244180646", "status": "affected", "version": "905f88ccebb14e42bcd19455b0d9c0d4808f1897", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/media/i2c/ds90ub913.c", "drivers/media/i2c/ds90ub953.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.78", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.14", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F1F895A-4A5A-4A7D-BF35-189CB10EACE2", "versionEndExcluding": "6.6.78", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "033BB7EE-C9A2-45EA-BAC9-87BB9D951BCD", "versionEndExcluding": "6.12.14", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E92CEE3-1FC3-4AFC-A513-DEDBA7414F00", "versionEndExcluding": "6.13.3", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ds90ub9x3: Fix extra fwnode_handle_put()\n\nThe ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as\npart of their remove process, and if the driver is removed multiple\ntimes, eventually leads to put \"overflow\", possibly causing memory\ncorruption or crash.\n\nThe fwnode_handle_put() is a leftover from commit 905f88ccebb1 (\"media:\ni2c: ds90ub9x3: Fix sub-device matching\"), which changed the code\nrelated to the sd.fwnode, but missed removing these fwnode_handle_put()\ncalls."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() Los controladores ub913 y ub953 llaman a fwnode_handle_put(priv->sd.fwnode) como parte de su proceso de eliminaci\u00f3n y, si el controlador se elimina varias veces, eventualmente conduce a un \"desbordamiento\" de put, posiblemente causando corrupci\u00f3n de memoria o falla. fwnode_handle_put() es un remanente del commit 905f88ccebb1 (\"media: i2c: ds90ub9x3: Fix sub-device matching\"), que cambi\u00f3 el c\u00f3digo relacionado con sd.fwnode, pero no elimin\u00f3 estas llamadas fwnode_handle_put()."}], "id": "CVE-2024-58003", "lastModified": "2026-08-04T11:22:36.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-27T03:15:11.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/474d7baf91d37bc411fa60de5bbf03c9dd82e18a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60b45ece41c5632a3a3274115a401cb244180646"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70743d6a8b256225675711e7983825f1be86062d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f4e4373322f8d4c19721831f7fb989e52d30dab0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()", "id": "2348589", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348589"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmedia: i2c: ds90ub9x3: Fix extra fwnode_handle_put()\nThe ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as\npart of their remove process, and if the driver is removed multiple\ntimes, eventually leads to put \"overflow\", possibly causing memory\ncorruption or crash.\nThe fwnode_handle_put() is a leftover from commit 905f88ccebb1 (\"media:\ni2c: ds90ub9x3: Fix sub-device matching\"), which changed the code\nrelated to the sd.fwnode, but missed removing these fwnode_handle_put()\ncalls."], "name": "CVE-2024-58003", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-58003\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58003\nhttps://lore.kernel.org/linux-cve-announce/2025022655-CVE-2024-58003-2b9b@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T16:01:27.671295+00:00", "updated": "2025-07-12T16:01:27.671346+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}