Security readout for executives and security teams
Plain-English summary
CVE-2024-58034 is a Linux kernel bug in the NVIDIA Tegra20 EMC memory driver. A local, low-privileged user could potentially trigger use-after-free behavior, which can compromise confidentiality, integrity, or availability. Exposure appears most relevant to systems running affected Linux kernels on Tegra20-related hardware or configurations.
Executive priority
Treat as high priority for embedded or Tegra20 Linux fleets, especially multi-user devices. For general server fleets without this hardware path, prioritize normal kernel patch cycles after confirming exposure.
Technical view
The issue is a CWE-416 use-after-free caused by incorrect Open Firmware device-node reference handling in tegra_emc_find_node_by_ram_code(). The fix replaces of_find_node_by_name() usage with child-node helpers to avoid releasing nodes still in use. CVSS 3.1 is 7.8, local attack vector, low complexity, low privileges, no user interaction.
Likely exposure
Likely exposure is limited to Linux systems using affected kernel versions and the tegra20-emc driver path. The source bundle lists Linux as affected and references stable kernel fixes plus a Debian LTS advisory. Non-Tegra20 systems may carry the code but are less likely to be reachable.
Exploitation context
The CVE is not listed as KEV in the bundle, and no provided source states active exploitation. The CVSS vector indicates local access with low privileges is required. Public evidence provided describes a bug found by an experimental verification tool, not a reported in-the-wild attack.
Researcher notes
The key technical condition is incorrect OF node reference lifetime in tegra_emc_find_node_by_ram_code(). Validation should focus on branch-specific kernel backports rather than only upstream version numbers. The provided evidence does not include exploit availability or a standalone mitigation beyond patched kernels/vendor updates.
Mitigation direction
- Apply vendor or distribution kernel updates containing the referenced stable fixes.
- Prioritize Tegra20 or embedded Linux assets using affected kernel branches.
- Review Debian LTS guidance if managing Debian-based systems.
- If patching is delayed, reduce local user access on exposed systems.
- Track kernel vendor advisories for exact fixed package versions.
Validation and detection
- Inventory Linux hosts and identify kernel versions and hardware platforms.
- Check whether Tegra20 EMC driver support is present or enabled.
- Confirm installed kernel includes the referenced stable fix for its branch.
- Verify Debian-based systems against the Debian LTS advisory where applicable.
- Record exceptions for systems awaiting vendor-confirmed fixed builds.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58034 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c3def10c610ae046aaa61d00528e7bd15e4ad8d3CVE reference, Linux
- https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05CVE reference, Linux
- https://git.kernel.org/stable/c/c144423cb07e4e227a8572d5742ca2b36ada770dCVE reference, Linux
- https://git.kernel.org/stable/c/3b02273446e23961d910b50cc12528faec649fb2CVE reference, Linux
- https://git.kernel.org/stable/c/755e44538c190c31de9090d8e8821d228fcfd416CVE reference, Linux
- https://git.kernel.org/stable/c/b9784e5cde1f9fb83661a70e580e381ae1264d12CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.