Skip to content
Fencer Vulns
high 7.1

CVE-2024-58007 json

soc: qcom: socinfo: Avoid out of bounds read of serial number

published 2025-02-27 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-5207

cvss
7.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: socinfo: Avoid out of bounds read of serial number

On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always:

db410c:/sys/devices/soc0$ cat serial_number 2644893864

The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not have support for the serial_num field in the socinfo struct. There is an existing check to avoid exposing the serial number in that case, but it's not correct: When checking the item_size returned by SMEM, we need to make sure the *end* of the serial_num is within bounds, instead of comparing with the *start* offset. The serial_number currently exposed on MSM8916 devices is just an out of bounds read of whatever comes after the socinfo struct in SMEM.

Fix this by changing offsetof() to offsetofend(), so that the size of the field is also taken into account.

Patch / fix

  • Linux Linux 5.4.291, 5.10.235, 5.15.179, 6.1.129, 6.6.78, 6.12.14, 6.13.3, 6.14
  • linux Debian 12 6.1.129-1
  • linux Debian 14, Debian 13 6.12.15-1

debian advisories DEBIAN-CVE-2024-58007

  • linux Ubuntu 20.04 LTS 5.4.0-216.236
  • linux Ubuntu 22.04 LTS 5.15.0-140.150
  • linux Ubuntu 24.04 LTS 6.8.0-64.67
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1146.156
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1084.91
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1032.34
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1149.158
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1083.92

ubuntu advisories UBUNTU-CVE-2024-58007

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.56.1.el10_2
  • rv RHEL 10.2 6.12.0-211.56.1.el10_2
  • perf RHEL 10.2 6.12.0-211.56.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.56.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.56.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.56.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.56.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.56.1.el10_2

red hat advisories RHSA-2026:68507RHSA-2025:7423

  • kernel-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-syms-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-coco_debug SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-source-coco SLE Module for Confidential Computing Technical Preview 15 SP6 6.4.0-15061.21.coco15sp6.1
  • kernel-source Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-default Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-kvmsmall Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1
  • kernel-default-base Linux Micro 6.1, Linux Micro 6.0 6.4.0-28.1.21.6

suse advisories SUSE-SU-2025:01919-1SUSE-SU-2025:20192-1SUSE-SU-2025:20270-1SUSE-SU-2025:20190-1SUSE-SU-2025:20260-1SUSE-SU-2025:1180-1

  • kernel AlmaLinux 10 6.12.0-211.56.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.56.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.56.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.56.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.56.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.56.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.56.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.56.1.el10_2

almalinux advisories ALSA-2026:68507ALSA-2025:7423

  • kernel Rocky Linux 10 6.12.0-211.56.1.el10_2.0.1

rocky linux advisories RLSA-2026:68507

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-58007 updated cvss 7.1

kernel: soc: qcom: socinfo: Avoid out of bounds read of serial number

  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.16.1.el9_6, perf 5.14.0-570.16.1.el9_6, rtla 5.14.0-570.16.1.el9_6, python3-perf 5.14.0-570.16.1.el9_6, kernel-devel-matched 5.14.0-570.16.1.el9_6, kernel-64k-devel-matched 5.14.0-570.16.1.el9_6, +7 more
    fixed: vendor fix RHSA-2025:7423
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.56.1.el10_2, perf 6.12.0-211.56.1.el10_2, rtla 6.12.0-211.56.1.el10_2, python3-perf 6.12.0-211.56.1.el10_2, kernel-devel-matched 6.12.0-211.56.1.el10_2, kernel-64k-devel-matched 6.12.0-211.56.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:68507
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.16.1.el9_6, kernel-64k 5.14.0-570.16.1.el9_6, kernel-core 5.14.0-570.16.1.el9_6, kernel-tools 5.14.0-570.16.1.el9_6, kernel-modules 5.14.0-570.16.1.el9_6, kernel-64k-core 5.14.0-570.16.1.el9_6, +27 more
    fixed: vendor fix RHSA-2025:7423
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.56.1.el10_2, kernel-64k 6.12.0-211.56.1.el10_2, kernel-core 6.12.0-211.56.1.el10_2, kernel-tools 6.12.0-211.56.1.el10_2, kernel-modules 6.12.0-211.56.1.el10_2, kernel-64k-core 6.12.0-211.56.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:68507
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.16.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.16.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.16.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.16.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.16.1.el9_6
    fixed: vendor fix RHSA-2025:7423
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.56.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.56.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.56.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.56.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.56.1.el10_2
    fixed: vendor fix RHSA-2026:68507
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.16.1.el9_6, kernel-rt-64k 5.14.0-570.16.1.el9_6, kernel-rt-core 5.14.0-570.16.1.el9_6, kernel-rt-modules 5.14.0-570.16.1.el9_6, kernel-rt-64k-core 5.14.0-570.16.1.el9_6, kernel-rt-debug-core 5.14.0-570.16.1.el9_6, +14 more
    fixed: vendor fix RHSA-2025:7423
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.56.1.el10_2, kernel-rt-64k 6.12.0-211.56.1.el10_2, kernel-rt-core 6.12.0-211.56.1.el10_2, kernel-rt-modules 6.12.0-211.56.1.el10_2, kernel-rt-64k-core 6.12.0-211.56.1.el10_2, kernel-rt-debug-core 6.12.0-211.56.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:68507
show 3 more
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.16.1.el9_6, kernel-rt-kvm 5.14.0-570.16.1.el9_6, kernel-rt-core 5.14.0-570.16.1.el9_6, kernel-rt-modules 5.14.0-570.16.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.16.1.el9_6, kernel-rt-debug-core 5.14.0-570.16.1.el9_6, +6 more
    fixed: vendor fix RHSA-2025:7423
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.56.1.el10_2, kernel-rt-core 6.12.0-211.56.1.el10_2, kernel-rt-modules 6.12.0-211.56.1.el10_2, kernel-rt-debug-core 6.12.0-211.56.1.el10_2, kernel-rt-modules-core 6.12.0-211.56.1.el10_2, kernel-rt-debug-modules 6.12.0-211.56.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:68507
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.