CVE-2024-39461

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39461
In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws, so that it can warn when hws is accessed out of bounds. As noted in that change, the __counted_by member must be initialized with the number of elements before the first array access happens, otherwise there will be a warning from each access prior to the initialization because the number of elements is zero. This occurs in raspberrypi_discover_clocks() due to ->num being assigned after ->hws has been accessed: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-raspberrypi.c:374:4 index 3 is out of range for type 'struct clk_hw *[] __counted_by(num)' (aka 'struct clk_hw *[]') Move the ->num initialization to before the first access of ->hws, which clears up the warning.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f Patch
https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c Patch
https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 Patch
https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f Patch
https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c Patch
https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 09:27

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f - Patch () https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f - Patch
References () https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c - Patch () https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c - Patch
References () https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 - Patch () https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 - Patch

03 Sep 2024, 18:12

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: bcm: rpi: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") anotó el miembro hws de 'struct clk_hw_onecell_data' con __counted_by, que informa al sanitizante de los límites sobre la cantidad de elementos en hws, para que pueda advertir cuando se accede a hws fuera de los límites. Como se señaló en ese cambio, el miembro __counted_by debe inicializarse con la cantidad de elementos antes de que ocurra el primer acceso a la matriz; de lo contrario, habrá una advertencia de cada acceso antes de la inicialización porque la cantidad de elementos es cero. Esto ocurre en raspberrypi_discover_clocks() debido a que ->num se asigna después de que se haya accedido a ->hws: UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-raspberrypi.c:374:4 index 3 está fuera del rango para el tipo 'struct clk_hw *[] __counted_by(num)' (también conocido como 'struct clk_hw *[]') Mueva la inicialización ->num antes del primer acceso de ->hws, lo que borra la advertencia.
CWE CWE-129
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f - () https://git.kernel.org/stable/c/6dc445c1905096b2ed4db1a84570375b4e00cc0f - Patch
References () https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c - () https://git.kernel.org/stable/c/9562dbe5cdbb16ac887d27ef6f179980bb99193c - Patch
References () https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 - () https://git.kernel.org/stable/c/cdf9c7871d58d3df59d2775982e3533adb8ec920 - Patch

25 Jun 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-25 15:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39461

Mitre link : CVE-2024-39461

CVE.ORG link : CVE-2024-39461

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-129

Improper Validation of Array Index