CVE-2024-47686

What it actually does

Off-by-one condition in ep93xx_div_recalc_rate allows an out-of-bounds read from the psc->div[] array when the divisor index equals the number of registered divisors, resulting in memory corruption or information disclosure.

Why it matters to the business

Systems using affected ep93xx-based embedded Linux kernels face elevated risk of crashes or data leaks; the large number of downstream dependents increases exposure across IoT and industrial devices.

How an attack unfolds

An attacker with local access or the ability to influence clock configuration triggers recalculation of an ep93xx clock rate using a divisor index that matches the array size, causing the kernel to read past the allocated buffer and potentially leak kernel memory or crash the system.

How to fix it

Update the Linux kernel to a version containing commit 7a5bd2fb92388c51d267f6ce57c40f1cca8af1e0 or later; rebuild and deploy the fixed kernel image on all affected ep93xx devices.

How to confirm the fix worked

Confirm the patch is present by checking that ep93xx_div_recalc_rate uses >= instead of > when comparing the divisor index against psc->num_div; run kernel self-tests or exercise clock registration paths under memory debugging tools.

Typical attack path

1. Identify ep93xx platform or load a driver that registers adc_divisors or similar tables
2. Trigger clock rate recalculation via clk_get_rate or equivalent API with crafted divisor value
3. Cause the >= check to fail and perform out-of-bounds array access
4. Observe resulting kernel oops, panic, or memory disclosure for further exploitation

How to detect it

Review kernel logs and dmesg for faults originating from ep93xx clock code; inspect loaded modules and clock provider registration for use of ep93xx_divisors tables; correlate with any recent local privilege-escalation attempts on Linux systems.

What your security team should do

• Prioritize patching of internet-facing or high-value ep93xx systems within standard change windows
• Monitor kernel logs for oops or panic messages referencing ep93xx_div_recalc_rate
• Limit unprivileged local access on embedded devices until updates are applied