CVE-2024-42100

What it actually does

The probe routine incorrectly invokes hw_to_ccu_common on clock hardware entries that are not wrapped in a ccu_common structure, producing an invalid pointer that is later dereferenced and resulting in memory corruption.

Why it matters to the business

Systems running the affected Linux kernel on Allwinner-based hardware may experience kernel panics or instability during boot, leading to downtime and requiring emergency patching or reboots.

How an attack unfolds

An attacker with the ability to trigger module loading or device probe on a vulnerable kernel (for example via a crafted device tree or local module insertion) causes the faulty sunxi_ccu_probe path to execute, resulting in the invalid dereference.

How to fix it

Update the Linux kernel to the commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 or later; rebuild and deploy the fixed kernel image, then reboot affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit a38297e3fb012ddfa7ce0321a7e5a8daeb1872b6 and verify that sunxi_ccu_probe no longer contains the hw_to_ccu_common call inside the initial rate-range loop.

Typical attack path

1. Gain local execution or load a kernel module on the target system
2. Trigger device enumeration that reaches sunxi_ccu_probe
3. Force the loop over desc->ccu_clks to call hw_to_ccu_common on a non-ccu_common entry
4. Trigger the subsequent invalid pointer dereference and resulting crash or corruption

How to detect it

Inspect kernel boot logs and dmesg for sunxi_ccu_probe or hw_to_ccu_common related oops/panic entries; search auditd or kernel audit logs for unexpected module loads involving sunxi-ng clocks.

What your security team should do

• Prioritize patching kernel packages on all systems using sunxi-ng clocks
• Reboot into the fixed kernel image as soon as the package is available
• Monitor boot logs for sunxi_ccu related oops or panic messages until remediation is complete