CVE-2024-58069 (GCVE-0-2024-58069)

Vulnerability from cvelistv5 – Published: 2025-03-06 15:54 – Updated: 2026-08-05 11:47
VLAI
Title
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
Summary
In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem client uses a buffer size less than 4 bytes, regmap_read will write out of bounds as it expects the buffer to point at an unsigned int. Fix this by using an intermediary unsigned int to hold the value.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < 21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < 6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < e5536677da803ed54a29a446515c28dce7d3d574 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < 9adefa7b9559d0f21034a5d5ec1b55840c9348b9 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < e5e06455760f2995b16a176033909347929d1128 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < 517aedb365f2c94e2d7e0b908ac7127df76203a1 (git)
Affected: fadfd092ee9138825d8c2a4f95719d2e2e3202b9 , < 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c (git)
Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.4.291 , ≤ 5.4.* (semver)
Unaffected: 5.10.235 , ≤ 5.10.* (semver)
Unaffected: 5.15.179 , ≤ 5.15.* (semver)
Unaffected: 6.1.129 , ≤ 6.1.* (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-58069",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:27:38.670709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:36.659Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:34:03.211Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/rtc/rtc-pcf85063.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "e5536677da803ed54a29a446515c28dce7d3d574",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "9adefa7b9559d0f21034a5d5ec1b55840c9348b9",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "e5e06455760f2995b16a176033909347929d1128",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "517aedb365f2c94e2d7e0b908ac7127df76203a1",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            },
            {
              "lessThan": "3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c",
              "status": "affected",
              "version": "fadfd092ee9138825d8c2a4f95719d2e2e3202b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/rtc/rtc-pcf85063.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.235",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.179",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.129",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.291",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.235",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.179",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.129",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\n\nThe nvmem interface supports variable buffer sizes, while the regmap\ninterface operates with fixed-size storage. If an nvmem client uses a\nbuffer size less than 4 bytes, regmap_read will write out of bounds\nas it expects the buffer to point at an unsigned int.\n\nFix this by using an intermediary unsigned int to hold the value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable callback is reached by reading the local sysfs binary attribute /sys/bus/nvmem/devices/pcf85063_nvram*/nvmem (or by an in-kernel nvmem-cell consumer); no network or adjacent-network path exists to an I2C RTC driver.\nAC:L - A single open()+read() with a count under 4 bytes deterministically causes regmap_read() to store 4 bytes into the smaller kernfs-allocated buffer; there is no race, no timing window, and no condition outside the attacker\u0027s control.\nPR:L - nvmem_cfg does not set root_only, so nvmem_bin_attr_get_umode() grants mode 0644 and any unprivileged local user (or container process) can read the nvmem attribute and trigger the overflow.\nUI:N - The attacker triggers the write entirely on their own by reading a sysfs file; no victim action, mount, or file open by another user is required.\nS:U - The out-of-bounds write corrupts kernel heap/stack memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The 3-byte out-of-bounds write corrupts memory adjacent to the target buffer (including stack slots holding lengths, indices and pointers in nvmem_cell_prepare_write_buffer()), and such memory corruption can be leveraged to influence subsequent reads and disclose kernel memory.\nI:H - This is a straightforward out-of-bounds write (CWE-787) past a 1-byte heap or stack buffer, corrupting adjacent kernel objects and stack frame state, which per kernel scoring practice for OOB writes constitutes a high integrity impact.\nA:H - The OOB store smashes adjacent stack data (potentially the stack canary, causing a panic) and is a KASAN-reported slab-out-of-bounds write that panics on kasan.fault=panic/panic_on_warn builds, and it is repeatable at will by any local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:31.980Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128"
        },
        {
          "url": "https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c"
        }
      ],
      "title": "rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58069",
    "datePublished": "2025-03-06T15:54:09.480Z",
    "dateReserved": "2025-03-06T15:52:09.181Z",
    "dateUpdated": "2026-08-05T11:47:31.980Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58069",
      "date": "2026-08-05",
      "epss": "0.00224",
      "percentile": "0.13039"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58069\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-06T16:15:53.373\",\"lastModified\":\"2026-06-17T08:14:33.710\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\\n\\nThe nvmem interface supports variable buffer sizes, while the regmap\\ninterface operates with fixed-size storage. If an nvmem client uses a\\nbuffer size less than 4 bytes, regmap_read will write out of bounds\\nas it expects the buffer to point at an unsigned int.\\n\\nFix this by using an intermediary unsigned int to hold the value.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rtc: pcf85063: se corrige una posible escritura OOB en la lectura NVMEM PCF85063 La interfaz nvmem admite tama\u00f1os de b\u00fafer variables, mientras que la interfaz regmap opera con almacenamiento de tama\u00f1o fijo. Si un cliente nvmem usa un tama\u00f1o de b\u00fafer menor a 4 bytes, regmap_read escribir\u00e1 fuera de los l\u00edmites ya que espera que el b\u00fafer apunte a una int sin signo. Corrija esto usando una int sin signo intermedia para contener el valor.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/rtc/rtc-pcf85063.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"e5536677da803ed54a29a446515c28dce7d3d574\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"9adefa7b9559d0f21034a5d5ec1b55840c9348b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"e5e06455760f2995b16a176033909347929d1128\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"517aedb365f2c94e2d7e0b908ac7127df76203a1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\",\"lessThan\":\"3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/rtc/rtc-pcf85063.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.291\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.235\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.179\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.129\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.76\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:27:38.670709Z\",\"id\":\"CVE-2024-58069\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"5.4.291\",\"matchCriteriaId\":\"18F68456-FFB3-4E0E-A802-F3E41C67B10E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.235\",\"matchCriteriaId\":\"545121FA-DE31-4154-9446-C2000FB4104D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.179\",\"matchCriteriaId\":\"C708062C-4E1B-465F-AE6D-C09C46400875\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.129\",\"matchCriteriaId\":\"2DA5009C-C9B9-4A1D-9B96-78427E8F232C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.76\",\"matchCriteriaId\":\"A6D70701-9CB6-4222-A957-00A419878993\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2897389C-A8C3-4D69-90F2-E701B3D66373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-29T23:03:43+00:00",
      "cve": "CVE-2024-58069",
      "id": "CVE-2024-58069",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "614",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58069.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:34:03.211Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-58069\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:27:38.670709Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:57:29.106Z\"}}], \"cna\": {\"title\": \"rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable callback is reached by reading the local sysfs binary attribute /sys/bus/nvmem/devices/pcf85063_nvram*/nvmem (or by an in-kernel nvmem-cell consumer); no network or adjacent-network path exists to an I2C RTC driver.\\nAC:L - A single open()+read() with a count under 4 bytes deterministically causes regmap_read() to store 4 bytes into the smaller kernfs-allocated buffer; there is no race, no timing window, and no condition outside the attacker\u0027s control.\\nPR:L - nvmem_cfg does not set root_only, so nvmem_bin_attr_get_umode() grants mode 0644 and any unprivileged local user (or container process) can read the nvmem attribute and trigger the overflow.\\nUI:N - The attacker triggers the write entirely on their own by reading a sysfs file; no victim action, mount, or file open by another user is required.\\nS:U - The out-of-bounds write corrupts kernel heap/stack memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The 3-byte out-of-bounds write corrupts memory adjacent to the target buffer (including stack slots holding lengths, indices and pointers in nvmem_cell_prepare_write_buffer()), and such memory corruption can be leveraged to influence subsequent reads and disclose kernel memory.\\nI:H - This is a straightforward out-of-bounds write (CWE-787) past a 1-byte heap or stack buffer, corrupting adjacent kernel objects and stack frame state, which per kernel scoring practice for OOB writes constitutes a high integrity impact.\\nA:H - The OOB store smashes adjacent stack data (potentially the stack canary, causing a panic) and is a KASAN-reported slab-out-of-bounds write that panics on kasan.fault=panic/panic_on_warn builds, and it is repeatable at will by any local user.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"e5536677da803ed54a29a446515c28dce7d3d574\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"9adefa7b9559d0f21034a5d5ec1b55840c9348b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"e5e06455760f2995b16a176033909347929d1128\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"517aedb365f2c94e2d7e0b908ac7127df76203a1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fadfd092ee9138825d8c2a4f95719d2e2e3202b9\", \"lessThan\": \"3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/rtc/rtc-pcf85063.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.291\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.235\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.179\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.129\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.76\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/rtc/rtc-pcf85063.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4\"}, {\"url\": \"https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c\"}, {\"url\": \"https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574\"}, {\"url\": \"https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1\"}, {\"url\": \"https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9\"}, {\"url\": \"https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128\"}, {\"url\": \"https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1\"}, {\"url\": \"https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\\n\\nThe nvmem interface supports variable buffer sizes, while the regmap\\ninterface operates with fixed-size storage. If an nvmem client uses a\\nbuffer size less than 4 bytes, regmap_read will write out of bounds\\nas it expects the buffer to point at an unsigned int.\\n\\nFix this by using an intermediary unsigned int to hold the value.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.291\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.235\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.179\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.129\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.76\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.13\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.2\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"5.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:47:31.980Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-58069\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:47:31.980Z\", \"dateReserved\": \"2025-03-06T15:52:09.181Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-03-06T15:54:09.480Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.