CVE-2024-57998: OPP: add index check to assert to avoid buffer overflow in _read_freq()
In the Linux kernel, the following vulnerability has been resolved:
OPP: add index check to assert to avoid buffer overflow in readfreq()
Pass the freq index to the assert function to make sure we do not read a freq out of the opp->rates[] table when called from the indexed variants: devpmoppfindfreqexactindexed() or devpmoppfindfreqceil/floorindexed().
Add a secondary parameter to the assert function, unused for assertsingleclk() then add assertclkindex() which will check for the clock index when called from the indexed() find functions.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
OPP: add index check to assert to avoid buffer overflow in readfreq()
Pass the freq index to the assert function to make sure we do not read a freq out of the opp-rates[] table when called from the indexed variants: devpmoppfindfreqexactindexed() or devpmoppfindfreqceil/floorindexed().
Add a secondary parameter to the assert function, unused for assertsingleclk() then add assertclkindex() which will check for the clock index when called from the indexed() find functions.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.13-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Update the Linux kernel OPP code so indexed frequency lookup functions pass the frequency index to the assert function; keep the unused secondary parameter for assert_single_clk() and add assert_clk_index() to validate the clock index before reading opp->rates[].
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57998?
CVE-2024-57998 has a medium severity rating due to the potential for buffer overflow that could impact system stability.
How do I fix CVE-2024-57998?
To fix CVE-2024-57998, update the Linux kernel to the latest available version that addresses this vulnerability.
Which Linux kernel versions are affected by CVE-2024-57998?
CVE-2024-57998 affects Linux kernel versions between 6.7 and 6.13.2 as well as those between 6.6 and 6.6.76.
Can CVE-2024-57998 be exploited remotely?
CVE-2024-57998 is not known to be exploitable remotely; it requires local access to the system to exploit the buffer overflow.
What are the potential risks of CVE-2024-57998?
The potential risks include system crashes and unexpected behavior due to the buffer overflow vulnerability in the kernel.