CVE-2024-27433

What it actually does

Double-free of clk_data structure in the mt7622 apmixedsys clock driver remove function due to redundant mtk_free_clk_data() call after devm allocation, resulting in memory corruption.

Why it matters to the business

May cause kernel crashes or local privilege escalation on affected embedded Linux devices using MediaTek MT7622 hardware, though overall risk remains low due to limited attack surface and lack of known campaigns.

How an attack unfolds

An attacker with local access triggers driver removal or an error path in the clock probe/remove sequence to invoke the redundant free, leading to heap corruption that can be leveraged for code execution.

How to fix it

Update the Linux kernel to a version containing commit de3340533bd68a7b3d6be1841b8eb3fa6c762fe6 which removes the redundant mtk_free_clk_data() call.

How to confirm the fix worked

Inspect the clk_mt8135_apmixed_probe and remove functions in the mediatek clock driver source to confirm absence of the explicit mtk_free_clk_data() call after devm allocation.

Typical attack path

1. Obtain local access to the target system
2. Trigger removal or error handling in the mt7622-apmixedsys clock driver
3. Exploit resulting double-free for memory corruption and privilege escalation

How to detect it

Review kernel ring buffer and dmesg logs for double-free or slab corruption messages tied to clock or mediatek driver functions; no remote network indicators exist.

What your security team should do

• Apply the referenced kernel commit or later stable releases to all affected systems
• Restrict unprivileged module loading and driver unload capabilities where feasible
• Monitor kernel logs for oops or warnings involving apmixedsys clock operations