CVE-2024-57985 (GCVE-0-2024-57985)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:07 – Updated: 2026-08-05 11:47
VLAI
Title
firmware: qcom: scm: Cleanup global '__scm' on probe failures
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Cleanup global '__scm' on probe failures If SCM driver fails the probe, it should not leave global '__scm' variable assigned, because external users of this driver will assume the probe finished successfully. For example TZMEM parts ('__scm->mempool') are initialized later in the probe, but users of it (__scm_smc_call()) rely on the '__scm' variable. This fixes theoretical NULL pointer exception, triggered via introducing probe deferral in SCM driver with call trace: qcom_tzmem_alloc+0x70/0x1ac (P) qcom_tzmem_alloc+0x64/0x1ac (L) qcom_scm_assign_mem+0x78/0x194 qcom_rmtfs_mem_probe+0x2d4/0x38c platform_probe+0x68/0xc8
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 40289e35ca525f29a03989352ab207b6a9675475 , < 390d3baeba51a126f75c97b90ec28b9384ce4b84 (git)
Affected: 40289e35ca525f29a03989352ab207b6a9675475 , < faf1715798fe72b79e4432ce8c6d03ca69765425 (git)
Affected: 40289e35ca525f29a03989352ab207b6a9675475 , < 1e76b546e6fca7eb568161f408133904ca6bcf4f (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "390d3baeba51a126f75c97b90ec28b9384ce4b84",
              "status": "affected",
              "version": "40289e35ca525f29a03989352ab207b6a9675475",
              "versionType": "git"
            },
            {
              "lessThan": "faf1715798fe72b79e4432ce8c6d03ca69765425",
              "status": "affected",
              "version": "40289e35ca525f29a03989352ab207b6a9675475",
              "versionType": "git"
            },
            {
              "lessThan": "1e76b546e6fca7eb568161f408133904ca6bcf4f",
              "status": "affected",
              "version": "40289e35ca525f29a03989352ab207b6a9675475",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/qcom/qcom_scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: scm: Cleanup global \u0027__scm\u0027 on probe failures\n\nIf SCM driver fails the probe, it should not leave global \u0027__scm\u0027\nvariable assigned, because external users of this driver will assume the\nprobe finished successfully.  For example TZMEM parts (\u0027__scm-\u003emempool\u0027)\nare initialized later in the probe, but users of it (__scm_smc_call())\nrely on the \u0027__scm\u0027 variable.\n\nThis fixes theoretical NULL pointer exception, triggered via introducing\nprobe deferral in SCM driver with call trace:\n\n  qcom_tzmem_alloc+0x70/0x1ac (P)\n  qcom_tzmem_alloc+0x64/0x1ac (L)\n  qcom_scm_assign_mem+0x78/0x194\n  qcom_rmtfs_mem_probe+0x2d4/0x38c\n  platform_probe+0x68/0xc8"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The Qualcomm SCM driver is a platform firmware interface (SMC calls to TrustZone) with no network-facing surface; reaching the stale `__scm` requires local access to a consumer entry point such as the msm DRM render node or `/dev/fastrpc-*`.\nAC:H - The vulnerable state only exists if `qcom_scm_probe()` fails or defers after publishing `__scm` \u2014 a boot-time device-tree/driver-ordering condition the attacker cannot induce, and `suppress_bind_attrs = true` plus `subsys_initcall` registration removes any bind/unbind or module-reload path to force a re-probe.\nPR:L - Once the dangling `__scm` exists, an ordinary unprivileged local user can reach it \u2014 the a6xx zap-shader load path (`adreno_zap_shader_load()` from `a6xx_gpu.c:995`) is driven by GPU init on the msm render node, which unprivileged apps hold on Android, and `fastrpc` exposes another unprivileged device node.\nUI:N - No victim action is required; the stale pointer is consumed automatically by subsequent driver probes at boot or by the attacker\u0027s own GPU/fastrpc activity.\nS:U - The freed object, the dereferences, and any resulting corruption are all within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other domain.\nC:H - This is a use-after-free of a `devm_kzalloc()`\u0027d `struct qcom_scm` released by `devres_release_all()`; consumers read `mempool`, `dev`, and clk/icc pointers out of the reallocated slab object and use them as pointers, which per UAF scoring can be leveraged into arbitrary kernel memory disclosure.\nI:H - Controlling the reallocated object gives control of `__scm-\u003emempool` (fed to `gen_pool_alloc()`) and `__scm-\u003ecore_clk`/`__scm-\u003epath` (consumed by `clk_enable()`/`icc_set_bw()`, which chase `ops` function pointers), providing heap-spray-based write and control-flow-hijack primitives.\nA:H - The documented outcome is a kernel oops \u2014 a NULL/invalid dereference in `qcom_tzmem_alloc()` via `qcom_scm_assign_mem()` \u2014 and use-after-frees reliably panic the kernel even when not weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:11.635Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/390d3baeba51a126f75c97b90ec28b9384ce4b84"
        },
        {
          "url": "https://git.kernel.org/stable/c/faf1715798fe72b79e4432ce8c6d03ca69765425"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e76b546e6fca7eb568161f408133904ca6bcf4f"
        }
      ],
      "title": "firmware: qcom: scm: Cleanup global \u0027__scm\u0027 on probe failures",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57985",
    "datePublished": "2025-02-27T02:07:09.983Z",
    "dateReserved": "2025-02-27T02:04:28.913Z",
    "dateUpdated": "2026-08-05T11:47:11.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57985",
      "date": "2026-10-01",
      "epss": "0.00206",
      "percentile": "0.09579"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/qcom/qcom_scm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "390d3baeba51a126f75c97b90ec28b9384ce4b84",
                    "status": "affected",
                    "version": "40289e35ca525f29a03989352ab207b6a9675475",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "faf1715798fe72b79e4432ce8c6d03ca69765425",
                    "status": "affected",
                    "version": "40289e35ca525f29a03989352ab207b6a9675475",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1e76b546e6fca7eb568161f408133904ca6bcf4f",
                    "status": "affected",
                    "version": "40289e35ca525f29a03989352ab207b6a9675475",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/qcom/qcom_scm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.13",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2C65B261-0C55-4563-835E-FD44483D02B3",
                    "versionEndExcluding": "6.12.13",
                    "versionStartIncluding": "6.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6D4116B1-1BFD-4F23-BA84-169CC05FC5A3",
                    "versionEndExcluding": "6.13.2",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: scm: Cleanup global \u0027__scm\u0027 on probe failures\n\nIf SCM driver fails the probe, it should not leave global \u0027__scm\u0027\nvariable assigned, because external users of this driver will assume the\nprobe finished successfully.  For example TZMEM parts (\u0027__scm-\u003emempool\u0027)\nare initialized later in the probe, but users of it (__scm_smc_call())\nrely on the \u0027__scm\u0027 variable.\n\nThis fixes theoretical NULL pointer exception, triggered via introducing\nprobe deferral in SCM driver with call trace:\n\n  qcom_tzmem_alloc+0x70/0x1ac (P)\n  qcom_tzmem_alloc+0x64/0x1ac (L)\n  qcom_scm_assign_mem+0x78/0x194\n  qcom_rmtfs_mem_probe+0x2d4/0x38c\n  platform_probe+0x68/0xc8"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: qcom: scm: Limpieza de la variable global \u0027__scm\u0027 en caso de fallos en la sonda Si el controlador SCM hace que la sonda falle, no deber\u00eda dejar asignada la variable global \u0027__scm\u0027, porque los usuarios externos de este controlador asumir\u00e1n que la sonda finaliz\u00f3 correctamente. Por ejemplo, las partes TZMEM (\u0027__scm-\u0026gt;mempool\u0027) se inicializan m\u00e1s tarde en la sonda, pero los usuarios de esta (__scm_smc_call()) dependen de la variable \u0027__scm\u0027. Esto corrige la excepci\u00f3n te\u00f3rica del puntero NULL, activada mediante la introducci\u00f3n de un aplazamiento de la sonda en el controlador SCM con seguimiento de llamadas: qcom_tzmem_alloc+0x70/0x1ac (P) qcom_tzmem_alloc+0x64/0x1ac (L) qcom_scm_assign_mem+0x78/0x194 qcom_rmtfs_mem_probe+0x2d4/0x38c platform_probe+0x68/0xc8"
          }
        ],
        "id": "CVE-2024-57985",
        "lastModified": "2026-08-04T11:22:34.447",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-27T02:15:11.703",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1e76b546e6fca7eb568161f408133904ca6bcf4f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/390d3baeba51a126f75c97b90ec28b9384ce4b84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/faf1715798fe72b79e4432ce8c6d03ca69765425"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:03:45+00:00",
      "cve": "CVE-2024-57985",
      "id": "CVE-2024-57985",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: qcom: scm: Cleanup global \u0027__scm\u0027 on probe failures",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57985.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:35:07Z",
      "cve": "CVE-2024-57985",
      "id": "CVE-2024-57985",
      "initial_release_date": "2025-02-28T02:23:28Z",
      "product_status:known_not_affected": "469",
      "product_status:recommended": "78",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-57985",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-57985.json",
      "version": "19"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.