CVE-2024-53158

What it actually does

Array underflow / out-of-bounds read before the start of geni_se->clk_perf_tbl[] in geni_se_clk_tbl_get() because the frequency-duplication termination check is performed on the first loop iteration.

Why it matters to the business

Kernel memory corruption or information disclosure risk on Qualcomm SoC devices; may cause crashes or stability issues in embedded, mobile, and IoT Linux deployments.

How an attack unfolds

An attacker with local access or the ability to trigger clock-rate configuration on a GENI SE controller forces the loop in geni_se_clk_tbl_get() to execute its first-iteration underflow check, reading out-of-bounds kernel memory.

How to fix it

Upgrade the Linux kernel to the commit 37cdd4f0c266560b7b924c42361eeae3dc5f0c3e or apply the equivalent stable backport that adds a first-iteration guard before the frequency check.

How to confirm the fix worked

Inspect the source of geni_se_clk_tbl_get() for the added first-iteration guard; verify the running kernel contains commit 37cdd4f0c266560b7b924c42361eeae3dc5f0c3e or later via git describe or kernel version string.

Typical attack path

1. Obtain local execution or trigger device initialization on affected Qualcomm hardware
2. Invoke code paths that call geni_se_clk_tbl_get() during clock table population
3. Trigger the faulty first-iteration comparison leading to underflow read
4. Leverage resulting out-of-bounds data for further exploitation or denial of service

How to detect it

Search kernel logs for oops or BUG reports mentioning geni_se_clk_tbl_get, clk_perf_tbl underflow, or array bounds violations on Qualcomm platforms; review audit logs for unexpected local processes triggering SE clock configuration.

• geni_se_clk_tbl_get
• clk_perf_tbl
• array underflow
• clk_round_rate

What your security team should do

• Patch all affected Linux kernels on Qualcomm-based systems with the highest priority
• Monitor for kernel oops/panics referencing geni-se or clk_perf_tbl
• Limit untrusted local code execution on embedded devices until patched