{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-53192", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-11-19T17:17:25.013Z", "datePublished": "2024-12-27T13:49:34.608Z", "dateUpdated": "2026-08-05T11:44:32.673Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:44:32.673Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: clk-loongson2: Fix potential buffer overflow in flexible-array member access\n\nFlexible-array member `hws` in `struct clk_hw_onecell_data` is annotated\nwith the `counted_by()` attribute. This means that when memory is\nallocated for this array, the _counter_, which in this case is member\n`num` in the flexible structure, should be set to the maximum number of\nelements the flexible array can contain, or fewer.\n\nIn this case, the total number of elements for the flexible array is\ndetermined by variable `clks_num` when allocating heap space via\n`devm_kzalloc()`, as shown below:\n\n289 struct loongson2_clk_provider *clp;\n\t...\n296 for (p = data; p->name; p++)\n297 clks_num++;\n298\n299 clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),\n300 GFP_KERNEL);\n\nSo, `clp->clk_data.num` should be set to `clks_num` or less, and not\nexceed `clks_num`, as is currently the case. Otherwise, if data is\nwritten into `clp->clk_data.hws[clks_num]`, the instrumentation\nprovided by the compiler won't detect the overflow, leading to a\nmemory corruption bug at runtime.\n\nFix this issue by setting `clp->clk_data.num` to `clks_num`." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The affected code is an SoC clock-controller platform driver reached only through in-kernel probe/clock-lookup paths on the local system; there is no network- or peer-facing input. Local access to the device (Loongson-2K embedded/industrial boards) is the applicable vector.\nAC:L - The off-by-one counter is unconditional and deterministic — no race, no timing window, and no memory-layout luck is needed for index `clks_num` to slip past both the `__counted_by` instrumentation and the `of_clk_hw_onecell_get()` bound check.\nPR:L - No capability or privilege check exists anywhere on the affected path (`of_clk_get* → __of_clk_get_hw_from_provider → of_clk_hw_onecell_get`); the weakened bound is exercised by ordinary clock consumers. Between low and high privileges the more severe value is taken.\nUI:N - The out-of-range access occurs autonomously during driver probe and clock-provider resolution; no victim action is required.\nS:U - Corruption and disclosure stay within the kernel's own memory and security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `of_clk_hw_onecell_get()` returns `hws[clks_num]`, a pointer read beyond the `devm_kzalloc()` allocation, exposing adjacent slab contents that are then dereferenced as a `struct clk_hw` — an out-of-bounds read leveragable for kernel memory disclosure.\nI:H - The inflated `num` disables the compiler's `counted_by` overflow detection, so a store to `hws[clks_num]` writes a kernel pointer into the neighbouring heap object undetected, and the OOB-read pointer is subsequently written through via `kref_get(&core->ref)` — a controlled-value out-of-bounds write primitive.\nA:H - Dereferencing the out-of-bounds `clk_hw` pointer (`hw->core`, `core->owner`) or corrupting the adjacent slab object reliably produces an oops or panic, and it happens at boot/probe time so the system fails to come up." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/clk-loongson2.c" ], "versions": [ { "version": "9796ec0bd04bb0e70487127d44949ca0554df5d3", "lessThan": "b96fc194984d0c82de1ca2b4166b35b1298b216c", "status": "affected", "versionType": "git" }, { "version": "9796ec0bd04bb0e70487127d44949ca0554df5d3", "lessThan": "1bf8877150128c3abd9d233886a05f6966fbf0c7", "status": "affected", "versionType": "git" }, { "version": "9796ec0bd04bb0e70487127d44949ca0554df5d3", "lessThan": "02fb4f0084331ef72c28d0c70fcb15d1bea369ec", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/clk/clk-loongson2.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.11", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.2", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.11.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b96fc194984d0c82de1ca2b4166b35b1298b216c" }, { "url": "https://git.kernel.org/stable/c/1bf8877150128c3abd9d233886a05f6966fbf0c7" }, { "url": "https://git.kernel.org/stable/c/02fb4f0084331ef72c28d0c70fcb15d1bea369ec" } ], "title": "clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-53192", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-02-18T16:03:52.402922Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T16:06:09.354Z" } } ] } }