{"id":"CVE-2024-58069","state":"PUBLISHED","title":"rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\n\nThe nvmem interface supports variable buffer sizes, while the regmap\ninterface operates with fixed-size storage. If an nvmem client uses a\nbuffer size less than 4 bytes, regmap_read will write out of bounds\nas it expects the buffer to point at an unsigned int.\n\nFix this by using an intermediary unsigned int to hold the value.","publishedAt":"2025-03-06T15:54:09.480Z","updatedAt":"2026-08-05T11:47:31.980Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"e5536677da803ed54a29a446515c28dce7d3d574","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"9adefa7b9559d0f21034a5d5ec1b55840c9348b9","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"e5e06455760f2995b16a176033909347929d1128","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"517aedb365f2c94e2d7e0b908ac7127df76203a1","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rtc/rtc-pcf85063.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.2","versionType":"semver"},{"version":"5.4.291","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rtc/rtc-pcf85063.c"]}],"references":["https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4","https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c","https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574","https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1","https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9","https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128","https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1","https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c","https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/58xxx/CVE-2024-58069.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-58069","state":"PUBLISHED","datePublished":"2025-03-06T15:54:09.480Z","dateUpdated":"2026-08-05T11:47:31.980Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-03-06T15:52:09.181Z"},"containers":{"cna":{"title":"rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read\n\nThe nvmem interface supports variable buffer sizes, while the regmap\ninterface operates with fixed-size storage. If an nvmem client uses a\nbuffer size less than 4 bytes, regmap_read will write out of bounds\nas it expects the buffer to point at an unsigned int.\n\nFix this by using an intermediary unsigned int to hold the value."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"e5536677da803ed54a29a446515c28dce7d3d574","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"9adefa7b9559d0f21034a5d5ec1b55840c9348b9","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"e5e06455760f2995b16a176033909347929d1128","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"517aedb365f2c94e2d7e0b908ac7127df76203a1","versionType":"git"},{"version":"fadfd092ee9138825d8c2a4f95719d2e2e3202b9","status":"affected","lessThan":"3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rtc/rtc-pcf85063.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.2","versionType":"semver"},{"version":"5.4.291","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.235","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.179","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.129","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.76","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.13","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13.2","status":"unaffected","lessThanOrEqual":"6.13.*","versionType":"semver"},{"version":"6.14","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/rtc/rtc-pcf85063.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/21cd59fcb9952eb7505da2bdfc1eb9c619df3ff4"},{"url":"https://git.kernel.org/stable/c/6f2a8ca9a0a38589f52a7f0fb9425b9ba987ae7c"},{"url":"https://git.kernel.org/stable/c/e5536677da803ed54a29a446515c28dce7d3d574"},{"url":"https://git.kernel.org/stable/c/c72b7a474d3f445bf0c5bcf8ffed332c78eb28a1"},{"url":"https://git.kernel.org/stable/c/9adefa7b9559d0f21034a5d5ec1b55840c9348b9"},{"url":"https://git.kernel.org/stable/c/e5e06455760f2995b16a176033909347929d1128"},{"url":"https://git.kernel.org/stable/c/517aedb365f2c94e2d7e0b908ac7127df76203a1"},{"url":"https://git.kernel.org/stable/c/3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable callback is reached by reading the local sysfs binary attribute /sys/bus/nvmem/devices/pcf85063_nvram*/nvmem (or by an in-kernel nvmem-cell consumer); no network or adjacent-network path exists to an I2C RTC driver.\nAC:L - A single open()+read() with a count under 4 bytes deterministically causes regmap_read() to store 4 bytes into the smaller kernfs-allocated buffer; there is no race, no timing window, and no condition outside the attacker's control.\nPR:L - nvmem_cfg does not set root_only, so nvmem_bin_attr_get_umode() grants mode 0644 and any unprivileged local user (or container process) can read the nvmem attribute and trigger the overflow.\nUI:N - The attacker triggers the write entirely on their own by reading a sysfs file; no victim action, mount, or file open by another user is required.\nS:U - The out-of-bounds write corrupts kernel heap/stack memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The 3-byte out-of-bounds write corrupts memory adjacent to the target buffer (including stack slots holding lengths, indices and pointers in nvmem_cell_prepare_write_buffer()), and such memory corruption can be leveraged to influence subsequent reads and disclose kernel memory.\nI:H - This is a straightforward out-of-bounds write (CWE-787) past a 1-byte heap or stack buffer, corrupting adjacent kernel objects and stack frame state, which per kernel scoring practice for OOB writes constitutes a high integrity impact.\nA:H - The OOB store smashes adjacent stack data (potentially the stack canary, causing a panic) and is a KASAN-reported slab-out-of-bounds write that panics on kasan.fault=panic/panic_on_warn builds, and it is repeatable at will by any local user."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:47:31.980Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.4.291"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.10.235"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"5.15.179"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.1.129"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.6.76"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.12.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.13.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.2","versionEndExcluding":"6.14"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-58069","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-10-01T19:27:38.670709Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-01T19:36:36.659Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T19:34:03.211Z"}}]}}}