Linux · Linux Kernel · CVE-2024-58007
**Name of the Vulnerable Software and Affected Versions**
Linux kernel (affected versions not specified)
**Description**
A vulnerability in the Linux kernel has been resolved, specifically related to an out of bounds read of the serial number on MSM8916 devices. The serial number exposed in sysfs is constant and does not change across individual devices. The issue arises from an incorrect check when checking the item size returned by SMEM, where the end of the serial num field should be within bounds, instead of comparing with the start offset. This results in an out of bounds read of whatever comes after the socinfo struct in SMEM.
**Recommendations**
To resolve this issue, update the Linux kernel to a version that includes the fix, which changes offsetof() to offsetofend(), taking into account the size of the field.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.