Kernel Vulnerability in Linux Package: Double-Free Error in Mediatek Clock Handling
Summary
DEBIAN-CVE-2024-27433: In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk_mt8135_apmixed_probe() 'clk_data' is allocated with mtk_devm_alloc_clk_data(). Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various distributions, including Debian. The kernel's functionality includes process management, memory management, device drivers, and system calls. This specific vulnerability affects the Mediatek clock handling subsystem, which is crucial for managing clock signals in hardware components.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Mediatek clock handling code, specifically in the function clk_mt8135_apmixed_probe(). The issue arises from an improper error handling path where 'clk_data' is allocated using mtk_devm_alloc_clk_data(). If an error occurs, the subsequent call to mtk_free_clk_data() in the remove function leads to a double-free situation. This can potentially cause system instability, crashes, or exploitation by malicious actors, as it allows for memory corruption.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux package.
Conclusion
The vulnerability identified in the Linux kernel regarding Mediatek clock handling poses significant risks to system stability and security. It is crucial for users to update to the patched version to mitigate these risks effectively. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a double-free error in the Mediatek clock handling code within the Linux kernel, which can lead to memory corruption.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The consequences include system instability, crashes, and potential exploitation by attackers, leading to unauthorized access or control over the system.
Yes, a patch is available in the form of the updated Linux package version 6.7.12-1.
While there are no specific workarounds, it is advisable to monitor your system for any unusual behavior and plan to update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
