{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-26969", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.202Z", "datePublished": "2024-05-01T05:19:50.580Z", "dateUpdated": "2026-08-05T11:28:45.154Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:45.154Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: gcc-ipq8074: fix terminating of frequency table arrays\n\nThe frequency table arrays are supposed to be terminated with an\nempty element. Add such entry to the end of the arrays where it\nis missing in order to avoid possible out-of-bound access when\nthe table is traversed by functions like qcom_find_freq() or\nqcom_find_freq_floor().\n\nOnly compile tested." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable frequency-table walk lives in an on-SoC global clock-controller driver reached only through in-kernel `clk_set_rate()`/`clk_round_rate()` requests originating from local device access (the PCIe/QMP-PHY aux clock consumers and the sdhci-msm/ICE storage path). No network protocol, packet, or remote peer data reaches `qcom_find_freq()`.\nAC:L - The overrun is fully deterministic — any rate request exceeding the table's top entry (19.2 MHz for PCIe aux, 308.57 MHz for SDCC ICE core) runs `for (; f->freq; f++)` off the array end every time, with no race to win and no memory-layout grooming needed to leave the array. Only the exact bytes read afterwards depend on link layout, not the ability to trigger the defect.\nPR:L - No real-root or init-namespace capability check guards the rate-setting path; the affected RCGs are re-programmed by consumer drivers on paths a basic local user can provoke (device-node open triggering runtime-PM resume on the PCIe controller, eMMC/SD I/O through the ICE-backed storage path). Basic local privileges suffice rather than genuine root.\nUI:N - The out-of-bounds traversal happens entirely inside the kernel clock framework when a rate is requested during normal driver operation. No victim must mount a filesystem, open a file, or take any other action.\nS:U - The out-of-bounds read, the mis-programmed RCG registers, and any resulting fault all remain within the kernel's own security authority on the affected SoC. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - `qcom_find_freq()` reads an unbounded distance past the end of the array through adjacent kernel `.rodata` until it happens to hit a zero `freq` word, so the disclosure is not bounded to a few bytes. The out-of-bounds word is propagated back to the caller as `req->rate = f->freq` in `_freq_tbl_determine_rate()` and into readable clock state, potentially exposing relocated pointer values usable to defeat KASLR.\nI:L - There is no out-of-bounds write and no kernel memory corruption — `src` is validated by `qcom_find_src_index()` and `m`/`n`/`pre_div` are mask-limited before reaching hardware — but out-of-bounds-derived values are still programmed into the SoC's RCG control registers via `clk_rcg2_configure()`, mis-configuring the PCIe aux or SDCC inline-crypto-engine clock and risking corrupt transfers on the eMMC/SD path.\nA:H - With `IPQ_GCC_8074` built as a module the tables sit in vmalloc'd module `.rodata`, so the unbounded walk can hit an unmapped guard region and oops the kernel. Short of that, an out-of-spec divider/source programmed onto a live PCIe aux or storage ICE clock makes `update_config()` time out into `WARN(1)` — a panic under `panic_on_warn` — and can wedge the affected peripheral." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/gcc-ipq8074.c" ], "versions": [ { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "83fe1bbd9e259ad109827ccfbfc2488e0dea8e94", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "851cc19bdb02556fb13629b3e4fef6f2bdb038fe", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "9de184d4e557d550fb0b7b833b676bda4f269e4f", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "dd92b159c506804ac57adf3742d9728298bb1255", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "b6b31b4c67ea6bd9222e5b73b330554c57f2f90d", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "fc3ac2fcd0a7fad63eba1b359490a4b81720d0f9", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "be9e2752d823eca1d5af67014a1844a9176ff566", "status": "affected", "versionType": "git" }, { "version": "9607f6224b3966652ce3f4e620c4694df190b64a", "lessThan": "1040ef5ed95d6fd2628bad387d78a61633e09429", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/qcom/gcc-ipq8074.c" ], "versions": [ { "version": "4.16", "status": "affected" }, { "version": "0", "lessThan": "4.16", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.84", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.24", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.12", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.3", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "4.19.312" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.4.274" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.10.215" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "5.15.154" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.1.84" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.6.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.7.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.8.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.16", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27" }, { "url": "https://git.kernel.org/stable/c/83fe1bbd9e259ad109827ccfbfc2488e0dea8e94" }, { "url": "https://git.kernel.org/stable/c/851cc19bdb02556fb13629b3e4fef6f2bdb038fe" }, { "url": "https://git.kernel.org/stable/c/9de184d4e557d550fb0b7b833b676bda4f269e4f" }, { "url": "https://git.kernel.org/stable/c/dd92b159c506804ac57adf3742d9728298bb1255" }, { "url": "https://git.kernel.org/stable/c/b6b31b4c67ea6bd9222e5b73b330554c57f2f90d" }, { "url": "https://git.kernel.org/stable/c/fc3ac2fcd0a7fad63eba1b359490a4b81720d0f9" }, { "url": "https://git.kernel.org/stable/c/be9e2752d823eca1d5af67014a1844a9176ff566" }, { "url": "https://git.kernel.org/stable/c/1040ef5ed95d6fd2628bad387d78a61633e09429" } ], "title": "clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.840Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/83fe1bbd9e259ad109827ccfbfc2488e0dea8e94", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/851cc19bdb02556fb13629b3e4fef6f2bdb038fe", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9de184d4e557d550fb0b7b833b676bda4f269e4f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/dd92b159c506804ac57adf3742d9728298bb1255", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b6b31b4c67ea6bd9222e5b73b330554c57f2f90d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/fc3ac2fcd0a7fad63eba1b359490a4b81720d0f9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/be9e2752d823eca1d5af67014a1844a9176ff566", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/1040ef5ed95d6fd2628bad387d78a61633e09429", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26969", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:45:16.629888Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:44.899Z" } } ] }, "dataVersion": "5.2" }