{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-53192","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-11-19T17:17:25.013Z","datePublished":"2024-12-27T13:49:34.608Z","dateUpdated":"2025-05-04T09:55:24.466Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2025-05-04T09:55:24.466Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: clk-loongson2: Fix potential buffer overflow in flexible-array member access\n\nFlexible-array member `hws` in `struct clk_hw_onecell_data` is annotated\nwith the `counted_by()` attribute. This means that when memory is\nallocated for this array, the _counter_, which in this case is member\n`num` in the flexible structure, should be set to the maximum number of\nelements the flexible array can contain, or fewer.\n\nIn this case, the total number of elements for the flexible array is\ndetermined by variable `clks_num` when allocating heap space via\n`devm_kzalloc()`, as shown below:\n\n289         struct loongson2_clk_provider *clp;\n\t...\n296         for (p = data; p->name; p++)\n297                 clks_num++;\n298\n299         clp = devm_kzalloc(dev, struct_size(clp, clk_data.hws, clks_num),\n300                            GFP_KERNEL);\n\nSo, `clp->clk_data.num` should be set to `clks_num` or less, and not\nexceed `clks_num`, as is currently the case. Otherwise, if data is\nwritten into `clp->clk_data.hws[clks_num]`, the instrumentation\nprovided by the compiler won't detect the overflow, leading to a\nmemory corruption bug at runtime.\n\nFix this issue by setting `clp->clk_data.num` to `clks_num`."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/clk-loongson2.c"],"versions":[{"version":"9796ec0bd04bb0e70487127d44949ca0554df5d3","lessThan":"b96fc194984d0c82de1ca2b4166b35b1298b216c","status":"affected","versionType":"git"},{"version":"9796ec0bd04bb0e70487127d44949ca0554df5d3","lessThan":"1bf8877150128c3abd9d233886a05f6966fbf0c7","status":"affected","versionType":"git"},{"version":"9796ec0bd04bb0e70487127d44949ca0554df5d3","lessThan":"02fb4f0084331ef72c28d0c70fcb15d1bea369ec","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/clk/clk-loongson2.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.11.11","lessThanOrEqual":"6.11.*","status":"unaffected","versionType":"semver"},{"version":"6.12.2","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.13","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.11.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.13"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/b96fc194984d0c82de1ca2b4166b35b1298b216c"},{"url":"https://git.kernel.org/stable/c/1bf8877150128c3abd9d233886a05f6966fbf0c7"},{"url":"https://git.kernel.org/stable/c/02fb4f0084331ef72c28d0c70fcb15d1bea369ec"}],"title":"clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-53192","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-02-18T16:03:52.402922Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-02-18T16:06:09.354Z"}}]}}