CVE-2024-26968Improper Validation of Array Index in Linux

Severity
5.5MEDIUMNVD
EPSS
0.0%
top 95.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedMay 1
Latest updateJul 4

Description

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages9 packages

NVDlinux/linux_kernel6.46.6.24+2
Debianlinux/linux_kernel< 6.7.12-1+1
Ubuntulinux/linux_kernel< 6.8.0-35.35
CVEListV5linux/linuxd75b82cff48883b5e75abfd3930afa7a148ab4400204247cf3669b6021fb745c3b7f37ae392ab19c+4
debiandebian/linux< linux 6.7.12-1 (forky)

Patches

🔴Vulnerability Details

7
OSV
linux-oracle vulnerabilities2024-07-04
OSV
linux-azure, linux-gke vulnerabilities2024-06-14
OSV
linux-oem-6.8 vulnerabilities2024-06-11
OSV
linux, linux-ibm, linux-lowlatency, linux-raspi vulnerabilities2024-06-07
OSV
linux-aws, linux-gcp vulnerabilities2024-06-07

📋Vendor Advisories

8
Ubuntu
Linux kernel (Oracle) vulnerabilities2024-07-04
Ubuntu
Linux kernel vulnerabilities2024-06-14
Ubuntu
Linux kernel (OEM) vulnerabilities2024-06-11
Ubuntu
Linux kernel vulnerabilities2024-06-07
Ubuntu
Linux kernel vulnerabilities2024-06-07

💬Community

1
Bugzilla
CVE-2024-26968 kernel: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays2024-05-01