CVE-2024-58076

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

clk: qcom: gcc-sm6350: Add missing parent_map for two clocks

If a clk_rcg2 has a parent, it should also have parent_map defined,

otherwise we'll get a NULL pointer dereference when calling clk_set_rate

like the following:

[ 3.388105] Call trace:

[ 3.390664] qcom_find_src_index+0x3c/0x70 (P)

[ 3.395301] qcom_find_src_index+0x1c/0x70 (L)

[ 3.399934] _freq_tbl_determine_rate+0x48/0x100

[ 3.404753] clk_rcg2_determine_rate+0x1c/0x28

[ 3.409387] clk_core_determine_round_nolock+0x58/0xe4

[ 3.421414] clk_core_round_rate_nolock+0x48/0xfc

[ 3.432974] clk_core_round_rate_nolock+0xd0/0xfc

[ 3.444483] clk_core_set_rate_nolock+0x8c/0x300

[ 3.455886] clk_set_rate+0x38/0x14c

Add the parent_map property for two clocks where it's missing and also

un-inline the parent_data as well to keep the matching parent_map and

parent_data together.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References