{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26965", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.201Z", "datePublished": "2024-05-01T05:19:32.635Z", "dateUpdated": "2026-08-05T11:28:40.872Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:40.872Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-msm8974: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is the Qualcomm MMCC clock controller driver, reached only through in-kernel clock-rate requests originating from local device interfaces (DRM/KMS on /dev/dri/card*, V4L2 on /dev/video*, OCMEM). There is no network-facing path to the frequency-table walk.\nAC:L - The out-of-bounds walk is fully deterministic — any rate request exceeding the table maximum runs off the end, with no race, no timing window, and no dependence on memory layout the attacker cannot influence. The adjacent .data contents are fixed at build and registration time, so the outcome is reproducible on every attempt.\nPR:L - An unprivileged local user with ordinary access to the display or camera/video device nodes (standard for the video/render groups on the Android and embedded MSM8974/MSM8226 devices this driver targets) can drive rate requests through mdss_axi_clk and the *_ocmemnoc branches, which carry CLK_SET_RATE_PARENT into the two unterminated tables. No root or capability is needed.\nUI:N - The clock-rate request is issued by the attacker's own ioctl/modeset activity on the display or video device; no victim action or separate user is involved.\nS:U - The out-of-bounds read, the leaked data, and the resulting misprogrammed clock all remain within the kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The loop is an unbounded out-of-bounds read with no length check, walking adjacent .data that contains live kernel pointers (parent_map, freq_tbl, clkr.regmap, clkr.hw.core) in the neighbouring struct clk_rcg2. The OOB entry's freq is propagated to req->rate and surfaces to userspace via clk_round_rate() and the clk_rate debugfs node, disclosing kernel .data and defeating KASLR.\nI:L - The out-of-bounds src, pre_div, m and n values are written into the RCG CFG/M/N/D hardware registers, reprogramming the MMSS AXI / OCMEM NoC bus clock with an unintended source and divider — a real modification of system state. The values are not attacker-controlled and there is no out-of-bounds write into kernel memory, so this falls short of a full integrity compromise.\nA:H - The global out-of-bounds read triggers a KASAN global-OOB report (fatal under panic_on_warn) and the unterminated walk can run past the end of the section, while programming a garbage source select and divider into the multimedia bus clock can hang the MMSS bus and lock up the SoC." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/mmcc-msm8974.c" ], "versions": [ { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "99740c4791dc8019b0d758c5389ca6d1c0604d95", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "86bf75d9158f511db7530bc82a84b19a5134d089", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "8f562f3b25177c2055b20fd8cf000496f6fa9194", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "537040c257ab4cd0673fbae048f3940c8ea2e589", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "7e9926fef71e514b4a8ea9d11d5a84d52b181362", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ae99e199037c580b7350bfa3596f447a53bcf01f", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "ca2cf98d46748373e830a13d85d215d64a2d9bf2", "status": "affected", "versionType": "git" }, { "version": "d8b212014e69d6b6323773ce6898f224ef4ed0d6", "lessThan": "e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/mmcc-msm8974.c" ], "versions": [ { "version": "3.14", "status": "affected" }, { "version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "4.19.312" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.4.274" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.215" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.154" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.7.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95" }, { "url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089" }, { "url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060" }, { "url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194" }, { "url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589" }, { "url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362" }, { "url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f" }, { "url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2" }, { "url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96" } ], "title": "clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26965", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-28T17:50:48.637005Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:04.278Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.666Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/99740c4791dc8019b0d758c5389ca6d1c0604d95", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/86bf75d9158f511db7530bc82a84b19a5134d089", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3ff4a0f6a8f0ad4b4ee9e908bdfc3cacb7be4060", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/8f562f3b25177c2055b20fd8cf000496f6fa9194", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/537040c257ab4cd0673fbae048f3940c8ea2e589", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7e9926fef71e514b4a8ea9d11d5a84d52b181362", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ae99e199037c580b7350bfa3596f447a53bcf01f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ca2cf98d46748373e830a13d85d215d64a2d9bf2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e2c02a85bf53ae86d79b5fccf0a75ac0b78e0c96", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] } ] }, "dataVersion": "5.2" }