CVE-2024-53192: clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access
In the Linux kernel, the following vulnerability has been resolved:
clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access
Flexible-array member hws in struct clkhwonecelldata is annotated with the countedby() attribute. This means that when memory is allocated for this array, the counter, which in this case is member num in the flexible structure, should be set to the maximum number of elements the flexible array can contain, or fewer.
In this case, the total number of elements for the flexible array is determined by variable clksnum when allocating heap space via devmkzalloc(), as shown below:
289 struct loongson2clkprovider clp; ... 296 for (p = data; p->name; p++) 297 clksnum++; 298 299 clp = devmkzalloc(dev, structsize(clp, clkdata.hws, clksnum), 300 GFPKERNEL);
So, clp->clkdata.num should be set to clksnum or less, and not exceed clksnum, as is currently the case. Otherwise, if data is written into clp->clkdata.hws[clksnum], the instrumentation provided by the compiler won't detect the overflow, leading to a memory corruption bug at runtime.
Fix this issue by setting clp->clkdata.num to clksnum.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Configuration
When allocating the flexible-array member `hws` in `struct clk_hw_onecell_data` via `devm_kzalloc()` using `clks_num` for the array size, set the flexible-array counter `clp->clk_data.num` to `clks_num` (or fewer) so it cannot exceed the allocated element count; this aligns with the `counted_by()` annotation and prevents flexible-array access from overflowing.
Linux kernel clk-loongson2 driver clp->clk_data.num = clks_num
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53192?
The severity of CVE-2024-53192 has not been explicitly rated but it involves a potential buffer overflow that could lead to security vulnerabilities.
How do I fix CVE-2024-53192?
To fix CVE-2024-53192, update your Linux kernel to the latest patched version provided by the maintainers.
What software is affected by CVE-2024-53192?
CVE-2024-53192 affects the Linux kernel, particularly versions that include the clk-loongson2 module.
Can CVE-2024-53192 lead to a denial of service?
Yes, CVE-2024-53192 can potentially lead to a denial of service due to buffer overflow issues.
Who reported CVE-2024-53192?
CVE-2024-53192 was reported as part of the ongoing vulnerability assessment and patch management process within the Linux community.