{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26966", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.201Z", "datePublished": "2024-05-01T05:19:36.656Z", "dateUpdated": "2026-08-05T11:28:41.926Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:41.926Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: mmcc-apq8084: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a SoC clock-controller driver reached only through local interfaces — V4L2/DRM device nodes whose format and mode requests propagate into clk_set_rate/clk_round_rate, or debugfs. There is no network-facing path to qcom_find_freq().\nAC:L - The overrun is deterministic: any rate request exceeding the last table entry (466.8 MHz / 320 MHz) walks past the array end every time, with no race to win and no attacker-uncontrollable state. The adjacent .data layout is fixed at build time, so an attacker targeting a known device knows exactly what is read.\nPR:L - An unprivileged local user with access to the camera or display device nodes (routinely granted to normal apps via the media/graphics groups on Android and embedded builds) can drive a rate request into the affected RCGs through the CLK_SET_RATE_PARENT branch clocks. No root or init-namespace capability is required.\nUI:N - The rate request is issued synchronously from the attacker's own ioctl on a device node; no victim action, mount, or file-open by another user is needed.\nS:U - The out-of-bounds read, the disclosed data, and the misprogrammed clock registers all remain within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The traversal reads an unbounded number of out-of-bounds words from kernel .data, and the value read is returned to the caller as req->rate = f->freq, observable from userspace via clk_round_rate results and debugfs clk_rate. The adjacent memory is the struct clk_rcg2 containing parent_map, freq_tbl, and clkr.hw.init pointers, so kernel pointer values can be disclosed.\nI:H - The bogus out-of-bounds entry's src/pre_div/m/n fields are fed to __clk_rcg2_configure_mnd() and written into the RCG control registers, letting the attacker drive the MMSS AXI and OCMEM NoC bus clocks to an unvalidated, out-of-spec configuration that no code path was ever meant to produce.\nA:H - The loop has no upper bound and can walk off the end of the mapped section, and on the CLK_SET_RATE_PARENT path a garbage entry with n != 0 and m == 0 hits do_div(tmp, f->m), a kernel divide-by-zero oops. Even short of that, programming an out-of-spec rate on the multimedia AXI/NoC bus clock hangs the multimedia subsystem." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/mmcc-apq8084.c" ], "versions": [ { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "5533686e99b04994d7c4877dc0e4282adc9444a2", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "b2dfb216f32627c2f6a8041f2d9d56d102ab87c0", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "a09aecb6cb482de88301c43bf00a6c8726c4d34f", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "3aedcf3755c74dafc187eb76acb04e3e6348b1a9", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "185de0b7cdeaad8b89ebd4c8a258ff2f21adba99", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "9b4c4546dd61950e80ffdca1bf6925f42b665b03", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "7e5432401536117c316d7f3b21d46b64c1514f38", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "5638330150db2cc30b53eed04e481062faa3ece8", "status": "affected", "versionType": "git" }, { "version": "2b46cd23a5a2cf0b8d3583338b63409f5e78e7cd", "lessThan": "a903cfd38d8dee7e754fb89fd1bebed99e28003d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/mmcc-apq8084.c" ], "versions": [ { "version": "3.17", "status": "affected" }, { "version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "4.19.312" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.4.274" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.10.215" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "5.15.154" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.7.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2" }, { "url": "https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0" }, { "url": "https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f" }, { "url": "https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9" }, { "url": "https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99" }, { "url": "https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03" }, { "url": "https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38" }, { "url": "https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8" }, { "url": "https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d" } ], "title": "clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.707Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/5533686e99b04994d7c4877dc0e4282adc9444a2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b2dfb216f32627c2f6a8041f2d9d56d102ab87c0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a09aecb6cb482de88301c43bf00a6c8726c4d34f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/3aedcf3755c74dafc187eb76acb04e3e6348b1a9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/185de0b7cdeaad8b89ebd4c8a258ff2f21adba99", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9b4c4546dd61950e80ffdca1bf6925f42b665b03", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7e5432401536117c316d7f3b21d46b64c1514f38", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/5638330150db2cc30b53eed04e481062faa3ece8", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a903cfd38d8dee7e754fb89fd1bebed99e28003d", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26966", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:45:23.145806Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:47.058Z" } } ] }, "dataVersion": "5.2" }