CVE-2024-39462

What it actually does

Initialization of the element count in struct clk_hw_onecell_data occurs after the first access to the hws array in clk_dvp_probe(), allowing out-of-bounds access that triggers UBSAN array-index-out-of-bounds warnings and potential memory corruption.

Why it matters to the business

Kernel instability or crashes during device initialization on affected Linux systems can disrupt boot processes and clock management, with urgency increased by the 840 days since publication and listed threat actor interest despite low EPSS.

How an attack unfolds

An attacker triggers the bcm dvp clock driver probe function (potentially via Android kernel remote code execution techniques referenced by threat actors), causing the bounds sanitizer to detect or the kernel to perform out-of-bounds access on the uninitialized __counted_by array before num is set.

How to fix it

Apply the upstream fix that moves num assignment before the first hws access; for listed mattermost/mattermost GIT packages upgrade to one of the fixed commits (45093ef4be396d39748078f9205a88ba5756e0b9 or 51fdf7ee51c379a80fe852f24f69e463386581d3).

How to confirm the fix worked

Rebuild with UBSAN enabled and confirm absence of array-index-out-of-bounds warnings in drivers/clk/bcm/clk-bcm2711-dvp.c:59; verify num is initialized prior to any hws access in the probe function.

Typical attack path

1. Gain ability to load or trigger clk-bcm2711-dvp driver probe
2. Reach clk_dvp_probe() before num initialization
3. Perform first access to hws array while count is zero
4. Trigger out-of-bounds condition leading to memory corruption or crash

How to detect it

Search kernel logs for UBSAN array-index-out-of-bounds messages citing drivers/clk/bcm/clk-bcm2711-dvp.c; inspect probe call stacks involving clk_hw_onecell_data for uninitialized num values.

• UBSAN: array-index-out-of-bounds in drivers/clk/bcm/clk-bcm2711-dvp.c:59:2
• index 0 is out of range for type 'struct clk_hw *[] __counted_by(num)'

What your security team should do

• Prioritize patching Linux kernel clock drivers on all affected systems given high CVSS and 840 days of exposure
• Monitor for kernel oops or UBSAN reports referencing clk-bcm2711-dvp.c
• Apply fixed commits to mattermost/mattermost GIT instances where referenced