Memory Corruption Vulnerability in Linux Kernel: SSPM Clocks Issue
Summary
DEBIAN-CVE-2023-53274: In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: mt8183: Add back SSPM related clocks This reverts commit 860690a93ef23b567f781c1b631623e27190f101. Affects linux versions < 6.4.11-1. Fixed in 6.4.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is highly modular, allowing for various drivers and functionalities to be added or removed as needed. This vulnerability specifically affects the MT8183 clock driver, which manages power management co-processor clocks. The issue arises from the removal of SSPM related clocks, which, when not properly handled, can lead to memory corruption.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the MT8183 clock driver related to the handling of SSPM clocks. The removal of these clocks, previously deemed unnecessary, has led to potential out-of-bounds writes when the driver interacts with the new simple-probe mechanism. This mechanism allocates memory based on the clocks defined in the driver, which can lead to memory corruption if there are discrepancies in the device tree (DT) binding. Such corruption can cause crashes or unpredictable behavior in the system, with KASAN being able to detect these errors.
How To Fix
Minimum fixed version
6.4.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate risks.
Conclusion
The vulnerability in the Linux kernel related to the MT8183 clock driver poses significant risks, including memory corruption and system instability. It is essential to apply the available patch promptly to safeguard your system against potential exploitation.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves potential memory corruption due to the improper handling of SSPM clocks in the MT8183 clock driver.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The consequences include possible system crashes, memory corruption, and unpredictable behavior due to out-of-bounds writes.
Yes, a patch is available in version 6.4.11-1 of the Linux package. It is recommended to update to this version.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
