CVE-2024-58080: clk: qcom: dispcc-sm6350: Add missing parent_map for a clock
In the Linux kernel, the following vulnerability has been resolved:
clk: qcom: dispcc-sm6350: Add missing parentmap for a clock
If a clkrcg2 has a parent, it should also have parentmap defined, otherwise we'll get a NULL pointer dereference when calling clksetrate like the following:
[ 3.388105] Call trace: [ 3.390664] qcomfindsrcindex+0x3c/0x70 (P) [ 3.395301] qcomfindsrcindex+0x1c/0x70 (L) [ 3.399934] freqtbldeterminerate+0x48/0x100 [ 3.404753] clkrcg2determinerate+0x1c/0x28 [ 3.409387] clkcoredetermineroundnolock+0x58/0xe4 [ 3.421414] clkcoreroundratenolock+0x48/0xfc [ 3.432974] clkcoreroundratenolock+0xd0/0xfc [ 3.444483] clkcoresetratenolock+0x8c/0x300 [ 3.455886] clksetrate+0x38/0x14c
Add the parentmap property for the clock where it's missing and also un-inline the parentdata as well to keep the matching parentmap and parentdata together.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Add the missing parent_map property for the clock; for any clk_rcg2 with a parent, define parent_map and keep the matching parent_data together by un-inlining parent_data.
Linux kernel clk: qcom: dispcc-sm6350 parent_map = defined
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58080?
CVE-2024-58080 is classified as a low severity vulnerability due to the potential for NULL pointer dereference.
How do I fix CVE-2024-58080?
To fix CVE-2024-58080, ensure that the parent_map is defined for clk_rcg2 instances in the Linux kernel.
What systems are affected by CVE-2024-58080?
CVE-2024-58080 affects the Linux kernel, specifically within the qcom dispcc-sm6350 clock driver.
What is the impact of CVE-2024-58080?
The impact of CVE-2024-58080 includes a potential crash of the system due to a NULL pointer dereference when invoking clk_set_rate.
When was CVE-2024-58080 disclosed?
CVE-2024-58080 was resolved in a recent update of the Linux kernel, emphasizing the need for timely system updates.